CVE-2026-85642

{
  "etk_id": "ETK-2026-2294",
  "cve_id": "CVE-2026-85642",
  "display_id": "CVE-2026-85642",
  "ghsa_id": "GHSA-4w7f-p9m2-jxgx",
  "euvd_id": "EUVD-2026-107084",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated rate-limit exhaustion in Formidable Forms",
  "summary": "Formidable Forms versions earlier than 7.0 are affected. An unauthenticated attacker can deplete the daily allowance for payment gateway verification requests, causing legitimate verification attempts to be refused for up to 24 hours.",
  "mitigation": "Update Formidable Forms to version 7.0 or later.",
  "vendor": null,
  "product": "Formidable Forms",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 6.5, < 7.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "7.0"
      ],
      "package_name": "Formidable Forms",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.286575766666667,
  "t0_at": "2026-10-21T06:00:24.595000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T06:00:24.595000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T06:00:24.595000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85642"
    }
  }
}