CVE-2024-13666

Description

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers spoof their IP address and submit forms that may have IP-based restrictions.

PUBLISHED Reserved 2025-01-23 | Published 2025-03-22 | Updated 2026-04-08 | Assigner Wordfence

Problem types

CWE-20 Improper Input Validation

Product status

Timeline

Credits

Khayal Farzaliyev finder

References

www.wordfence.com/...-e27a-4492-b175-3b0846e4cf10?source=cve

plugins.trac.wordpress.org/...%2Ftrunk&sfp_email=&sfph_mail=

cve.org (CVE-2024-13666)

nvd.nist.gov (CVE-2024-13666)

Download JSON