CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 1.5.112 due to insufficient IP address validation and/or use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass antispam functionality in the Form Builder widgets.
Explanation of Vulnerability in Simple Terms
Unlimited Elements For Elementor versions up to 1.5.112 contain an integrity vulnerability that allows unauthenticated attackers to modify data over the network. The vulnerability requires no user interaction and can be exploited remotely. Site administrators should update to a version newer than 1.5.112 to remediate the issue.
What an attacker can do
Modify site data without authentication or user interaction.
Potential impact on your site
Attackers can alter site content or settings without logging in, potentially defacing pages or corrupting data.
Conditions required to exploit
Network access only; no authentication or user action required.
Key dates
External resources
Related vulnerabilities
