CVE-2025-12094 describes an IP header spoofing vulnerability in the OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin. The plugin improperly trusts client-supplied forwarded headers (e.g., CF-Connecting-IP, X-Forwarded-For) without validating that these headers come from trusted proxies. This flaw allows unauthenticated attackers to spoof their IP address, potentially bypassing IP-based security mechanisms such as blocking and rate limiting. The vulnerability affects all versions up to and including 1.2.53. The CVSS 3.1 base score is 5.3, indicating medium severity. There is no vendor advisory or patch information available to confirm remediation status.

An attacker can spoof IP addresses by sending arbitrary HTTP headers, thereby bypassing IP-based security controls implemented by the plugin. This may allow evasion of blocked IP lists and rate limiting protections, increasing the risk of spam or abuse through WordPress forms and comments protected by this plugin. There is no indication of direct confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the plugin or implementing additional network-level controls to validate forwarded headers. Avoid relying solely on client-supplied IP headers for security decisions.