CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers spoof their IP address and submit forms that may have IP-based restrictions.
Explanation of Vulnerability in Simple Terms
Fluent Forms versions up to 5.2.12 contain an input validation flaw that allows attackers to modify data without authentication. The vulnerability requires only network access and no user interaction. Site administrators should update to a version newer than 5.2.12 to prevent unauthorized data tampering.
What an attacker can do
Modify form data or submissions without logging in.
Potential impact on your site
Form submissions or stored data could be altered by unauthorized users.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
