The Formidable Forms WordPress plugin records a timestamp used for rate limiting payment gateway verification requests without first verifying the identity of the caller. As a result, an unauthenticated attacker can repeatedly initiate verification requests and consume the daily allowance, causing legitimate verification attempts to be denied for up to 24 hours. This vulnerability is classified as excessive resource consumption (CWE‑400) and results in a denial of service to the payment verification service.

The issue affects the Formidable Forms WordPress plugin for all versions before the 7.0 release, including the 6.5–6.35 line of releases.

The CVSS score of 7.5 indicates a high severity, whereas the EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to the payment gateway verification endpoint, which is inferred because the plug‑in does not check caller identity before rate limiting. The potential impact therefore is a service outage for legitimate users during the next 24 hours.