CVE-2025-12094: OOPSpam WordPress Auth Bypass Vulnerability

CVE-2025-12094 Overview

CVE-2025-12094 affects the OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin for WordPress. The plugin trusts client-controlled forwarded headers, including CF-Connecting-IP and X-Forwarded-For, without validating that the headers originate from trusted proxies. Unauthenticated attackers can spoof their source IP address by injecting arbitrary HTTP headers. This bypass defeats IP-based security controls, including blocked IP lists and rate limiting protections. All plugin versions up to and including 1.2.53 are affected. The weakness is classified under CWE-693: Protection Mechanism Failure.

Critical Impact
Unauthenticated attackers can spoof source IP addresses to bypass IP blocklists and rate limiting protections enforced by the plugin.

Affected Products

OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin — all versions up to and including 1.2.53
WordPress sites relying on the plugin for IP-based spam filtering
WordPress deployments where the plugin enforces blocked IP lists or rate limiting

Discovery Timeline

2025-10-31 - CVE-2025-12094 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12094

Vulnerability Analysis

The vulnerability resides in the plugin's client IP resolution logic within include/helpers.php. The affected helper function reads forwarded IP headers directly from the incoming HTTP request. It uses those headers as the authoritative source IP without confirming that the request arrived through a trusted upstream proxy or content delivery network. Because HTTP headers are user-controlled data, any unauthenticated client can supply arbitrary values.

When the plugin evaluates spam decisions, blocklist matches, or rate limit counters against this spoofed value, security controls fail open. An attacker can rotate through arbitrary IP addresses on every request. This defeats rate limiting because each spoofed IP resets the counter. It also defeats blocklists because the attacker can present an IP that is not on the deny list.

Root Cause

The root cause is unconditional trust in forwarded headers such as CF-Connecting-IP, X-Forwarded-For, X-Real-IP, and similar variants. Secure implementations require a proxy allowlist. The application must verify that REMOTE_ADDR corresponds to a known reverse proxy before honoring forwarded headers. The affected code in versions up to 1.2.49 can be reviewed in the WordPress Plugin Code Reference.

Attack Vector

Exploitation requires only the ability to send HTTP requests to the target WordPress site. The attacker adds a spoofed header such as X-Forwarded-For: 1.2.3.4 or CF-Connecting-IP: 8.8.8.8 to each request. The plugin consumes the spoofed value and applies its spam decision logic against the attacker-supplied IP. No authentication, user interaction, or special privileges are required.

Detection Methods for CVE-2025-12094

Indicators of Compromise

Inbound requests containing forwarded IP headers when the site is not fronted by a reverse proxy or CDN
Requests where X-Forwarded-For or CF-Connecting-IP values differ significantly from the connecting REMOTE_ADDR
Rapid form submissions or comment posts that appear to originate from many distinct IPs but share other request fingerprints such as User-Agent, TLS JA3, or timing
Spam or brute-force activity persisting after IP addresses have been added to the plugin blocklist

Detection Strategies

Log both REMOTE_ADDR and all forwarded IP headers at the web server layer for correlation
Alert when forwarded IP headers arrive from source addresses outside the known proxy or CDN allowlist
Correlate WordPress plugin activity with reverse proxy logs to detect discrepancies between reported and actual client IPs
Baseline normal header patterns for the site and flag deviations

Monitoring Recommendations

Enable verbose access logging on the WordPress front-end web server, capturing all IP-related headers
Monitor comment and form submission endpoints for high-cardinality spoofed IP distributions
Review Wordfence Vulnerability Intelligence for updated indicators

How to Mitigate CVE-2025-12094

Immediate Actions Required

Update the OOPSpam Anti-Spam plugin to a version later than 1.2.53 as soon as a fixed release is available
Audit the WordPress environment to confirm whether the site is actually behind a trusted reverse proxy or CDN
If the site is not behind a proxy, configure the web server or WordPress to ignore forwarded IP headers entirely
Review recent access logs for evidence of header-based blocklist evasion

Patch Information

A code change addressing the client IP resolution logic is available in the WordPress Plugin Changeset. Site operators should upgrade to a plugin release incorporating this changeset. Confirm the installed version in the WordPress admin plugin list after applying updates.

Workarounds

Strip inbound X-Forwarded-For, CF-Connecting-IP, X-Real-IP, and related headers at the edge if the site is not behind a legitimate proxy
If using Cloudflare or another CDN, restrict origin access to the CDN's published IP ranges so direct requests bypassing the proxy cannot reach the origin
Deploy a web application firewall rule to normalize or drop untrusted forwarded headers before they reach WordPress
Supplement IP-based controls with content-based or challenge-based anti-spam checks that do not rely on client IP

bash

# Example nginx configuration: only trust forwarded headers from known proxy ranges
set_real_ip_from 173.245.48.0/20;   # Cloudflare range (example)
set_real_ip_from 103.21.244.0/22;   # Cloudflare range (example)
real_ip_header CF-Connecting-IP;
real_ip_recursive on;

# Strip client-supplied forwarded headers on requests from untrusted sources
map $remote_addr $trusted_proxy {
    default 0;
    173.245.48.0/20 1;
    103.21.244.0/22 1;
}
if ($trusted_proxy = 0) {
    proxy_set_header X-Forwarded-For "";
    proxy_set_header CF-Connecting-IP "";
    proxy_set_header X-Real-IP "";
}