CVE-2024-6171 describes an IP address spoofing vulnerability in the Unlimited Elements For Elementor plugin for WordPress, affecting all versions up to and including 1.5.112. The issue arises from improper IP address validation and the use of less trusted sources (user-supplied HTTP headers) to determine client IP addresses. This flaw allows unauthenticated attackers to bypass antispam functionality in the plugin's Form Builder widgets by spoofing their IP address. The vulnerability is categorized under CWE-348 (Use of Less Trusted Source). The CVSS 3.1 base score is 5.3, indicating medium severity. No patch or official fix has been disclosed yet.

The vulnerability enables unauthenticated attackers to bypass antispam mechanisms in the Form Builder widgets of the affected plugin by spoofing IP addresses. This could lead to increased spam submissions or abuse of forms on WordPress sites using this plugin. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing additional server-side validation or filtering of HTTP headers used for IP detection to reduce spoofing risk. Monitor plugin updates from the vendor for a forthcoming patch.