Unauthenticated Attackers Can Bypass Antispam Functionality in Elementor Form Builder Widgets via IP Address Spoofing
CVE-2024-6171

5.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Unlimited Elements For Elementor (free Widgets, Addons, Templates)
Vendor
CVE Published:
9 July 2024

Summary

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 1.5.112 due to insufficient IP address validation and/or use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass antispam functionality in the Form Builder widgets.

Affected Version(s)

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) * <= 1.5.112

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/unlimited-elem...
https://plugins.trac.wordpress.org/browser/unlimited-elem...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khayal Farzaliyev
.