CVE-2025-12094: Oopspam Anti-Spam: Spam Protection For WordPress Forms & Comments No Captcha

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers (such as CF-Connecting-IP, X-Forwarded-For, and others) without verifying that those headers originate from legitimate, trusted proxies. This makes it possible for unauthenticated attackers to spoof their IP address and bypass IP-based security controls, including blocked IP lists and rate limiting protections, by sending arbitrary HTTP headers with their requests.

Affected products

• Oopspam Oopspam Anti-Spam: Spam Protection For WordPress Forms & Comments No Captcha: up to and including 1.2.53

Published 2025-10-31. Last modified 2026-10-07.