CVE-2025-12094: 
WordPress vulnerability analysis and mitigation

CVE-2025-12094 is an IP Header Spoofing vulnerability in the OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin for WordPress. It affects all versions up to and including 1.2.53, allowing unauthenticated attackers to bypass IP-based security controls by manipulating client-controlled HTTP headers. The vulnerability was disclosed on October 31, 2025, with Wordfence as the reporting CNA. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-693 (Protection Mechanism Failure): the plugin unconditionally trusts client-supplied HTTP headers — including CF-Connecting-IP, X-Forwarded-For, and similar forwarded headers — to determine the originating IP address of a request, without validating that these headers originate from a legitimate, trusted proxy. An attacker can craft arbitrary HTTP requests with spoofed values in these headers to present a different IP address to the plugin's security logic. The vulnerable code path is visible in include/helpers.php at line 268 of version 1.2.49, and the fix was applied in the changeset for the trunk branch (WordPress Trac (vuln), WordPress Trac (fix)).

Successful exploitation allows unauthenticated attackers to bypass IP-based spam and abuse protections enforced by the plugin, including blocked IP lists and rate limiting controls. This undermines the plugin's core anti-spam functionality, potentially enabling spam submissions, comment flooding, or form abuse at scale on affected WordPress sites. There is no direct confidentiality or availability impact; the primary consequence is an integrity impact through circumvention of protective controls (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-12094. The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any network attacker who can send HTTP requests to a vulnerable WordPress site. The EPSS score is approximately 0.059%, indicating a low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Feedly).

1. Reconnaissance: Identify WordPress sites running the OOPSpam Anti-Spam plugin version ≤ 1.2.53 by inspecting plugin directories, HTTP response headers, or using tools like WPScan.
2. Craft spoofed request: Prepare an HTTP request targeting a protected form or comment endpoint on the WordPress site, adding a forged header such as X-Forwarded-For: <trusted_or_unblocked_IP> or CF-Connecting-IP: <trusted_or_unblocked_IP>.
3. Bypass IP blocklist: Submit the crafted request; the plugin reads the attacker-controlled header value as the client's real IP, causing it to evaluate the spoofed IP instead of the actual source IP against its blocklist and rate limiter.
4. Abuse protected functionality: With IP-based controls bypassed, the attacker can submit spam content, flood forms, or perform repeated actions that would otherwise be rate-limited or blocked (WordPress Trac (vuln), Wordfence).

• Network: Repeated HTTP POST requests to WordPress form or comment endpoints from a single source IP, accompanied by varying X-Forwarded-For, CF-Connecting-IP, or similar headers cycling through different IP values.
• Logs: WordPress or web server access logs showing high-volume form/comment submissions with inconsistent or rotating forwarded IP header values; requests from IPs that should be blocked still successfully submitting content.
• Application Behavior: Unusual volume of spam comments or form submissions appearing despite IP-based blocking rules being configured in the OOPSpam plugin; rate limiting appearing ineffective against a persistent source.

Users should update the OOPSpam Anti-Spam plugin to version 1.2.54 or later, which includes the fix applied in the trunk changeset that corrects the IP header trust logic. The patch is available via the WordPress plugin repository. As a temporary workaround, site administrators can implement IP validation at the web server or CDN/proxy layer (e.g., only accepting CF-Connecting-IP from Cloudflare's known IP ranges) to prevent header spoofing before requests reach the plugin (WordPress Trac (fix), Wordfence).

Wordfence included CVE-2025-12094 in its weekly WordPress vulnerability report for the period of October 27 – November 2, 2025, noting the IP header spoofing issue as part of a broader roundup of plugin vulnerabilities. No significant independent researcher commentary or major media coverage has been identified for this vulnerability (Wordfence Blog).