Cyber Resilience

CVE-2024-6171

Medium

Published: 09 July 2024

Published
09 July 2024
Modified
08 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0020 42.0th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-6171 is a medium-severity Use of Less Trusted Source (CWE-348) vulnerability in Unlimited-Elements Unlimited Elements For Elementor \(Free Widgets\, Addons\, Templates\). Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 42.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 1.5.112 due to insufficient IP address validation and/or use of user-supplied HTTP headers as a…

more

primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass antispam functionality in the Form Builder widgets.

CWE(s)
CWE-348NVD-CWE-noinfo

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

unlimited-elements
unlimited elements for elementor \(free widgets\, addons\, templates\)
≤ 1.5.113

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
addresses: CWE-348

Prevents use of less-trusted or adversarial sources by requiring proof of origin and integrity before accepting responses.

References