CVE-2026-85642: Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS

Q: Which installations are affected?

Formidable Forms versions before 7.0 are affected. The issue concerns the payment gateway verification request rate limit.

Q: What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They can submit requests that cause the plugin to record timestamps against the daily verification allowance.

Q: What is the impact on legitimate users?

An attacker can consume the daily allowance for payment gateway verification requests. Legitimate verification attempts can then be refused for the following 24 hours.

Published Oct 21, 2026

Updated

The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.

Affected Software

1 affected component

Formidable Forms Formidable Forms WordPress plugin<7.0

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

Formidable Forms versions before 7.0 are affected. The issue concerns the payment gateway verification request rate limit.

What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They can submit requests that cause the plugin to record timestamps against the daily verification allowance.

What is the impact on legitimate users?

An attacker can consume the daily allowance for payment gateway verification requests. Legitimate verification attempts can then be refused for the following 24 hours.