The OOPSpam Anti‑Spam plugin for WordPress is vulnerable to IP header spoofing in all releases up to 1.2.53. The code trusts client‑controlled forwarded headers such as CF‑Connecting‑IP and X‑Forwarded‑For without confirming that they originate from trusted proxies. An attacker who can send arbitrary HTTP headers can therefore change the apparent source address of a request. This flaw enables unauthenticated users to bypass IP‑based defenses, including blacklists and rate‑limiting, and could be used to flood forms or comments from whitelisted IP ranges, ignoring security controls that rely on IP reputation.

The affected software is the OOPSpam Anti-Spam plugin named "Spam Protection for WordPress Forms & Comments (No CAPTCHA)". All installed versions through 1.2.53 are vulnerable; newer releases are presumed fixed.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog, further indicating limited exploitation activity. Attackers can exploit the flaw remotely by modifying outbound HTTP headers on any client connected to the WordPress site, provided the server accepts forwarded headers without validation. Because the attack requires no authentication and the input is untrusted, the risk is primarily to the integrity of IP‑based control mechanisms rather than to system compromise.