CVE-2024-6171
low-risk
Published 2024-07-09
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 1.5.112 due to insufficient IP address validation and/or use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass antispam functionality in the Form Builder widgets.
Do I need to act?
-
0.20% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10
Medium
NETWORK
/ LOW complexity
Affected Products (1)
Unlimited Elements For Elementor \(Free Widgets\, Addons\, Templates\)
Affected Vendors
References (8)
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/714acd7d-6d19-4087-bb2...
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/714acd7d-6d19-4087-bb2...
27
/ 100
low-risk
Severity
21/34 · High
Exploitability
1/34 · Minimal
Exposure
5/34 · Minimal