{"id":"CVE-2026-102564","kind":"vulnerability","aliases":["CVE-2026-102564"],"related":[],"title":"WordPress Dynific Addons for Elementor: unauthenticated shortcode execution through comments","description":"The The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a public post rendered through an AE template that includes the AE Post Comments widget, and for the attacker's comment to be visible on that page — a barrier removed once the attacker has a previously approved comment or when comment moderation is relaxed.","summary":"The Dynific Addons for Elementor WordPress plugin, up to and including version 1.3.0, passes an unvalidated value to do_shortcode, letting unauthenticated attackers run arbitrary WordPress shortcodes. An attacker can exploit it through a comment on a page that uses the AE Post Comments widget.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["comment-moderation-enabled","no-ae-post-comments-widget","plugin-not-installed"],"how_to_check":"- Check the installed version of the Dynific Addons for Elementor (formerly Anywhere Elementor) plugin in the WordPress plugins screen; versions up to and including `1.3.0` are listed as affected.\n- Look for the AE Post Comments widget in templates rendered on public posts.","fix":null,"status":"open","published_at":"2026-11-07T12:17:40+00:00","first_seen_at":"2026-11-07T12:47:07+00:00","triaged_at":"2026-11-07T12:49:00+00:00","updated_at":"2026-11-07T12:49:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T12:49:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Dynific Addons for Elementor: unauthenticated shortcode execution through comments","impact":"medium","summary":"The Dynific Addons for Elementor WordPress plugin, up to and including version 1.3.0, passes an unvalidated value to do_shortcode, letting unauthenticated attackers run arbitrary WordPress shortcodes. An attacker can exploit it through a comment on a page that uses the AE Post Comments widget.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary WordPress shortcodes on the site","analyst_note":"Check the NVD entry and the plugin's changelog for a fixed version and whether any shortcode runs beyond the stated impact.","how_to_check":"- Check the installed version of the Dynific Addons for Elementor (formerly Anywhere Elementor) plugin in the WordPress plugins screen; versions up to and including `1.3.0` are listed as affected.\n- Look for the AE Post Comments widget in templates rendered on public posts.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-ae-post-comments-widget","comment-moderation-enabled"],"who_is_affected":"Sites running the Dynific Addons for Elementor plugin, version 1.3.0 or earlier, where a public post is rendered through an AE template that includes the AE Post Comments widget. Exploitation also requires the attacker's comment to appear on that page, which is easier when comments are pre-approved or moderation is relaxed. Sites without the plugin or without that widget can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000765,"input_tokens":4357,"output_tokens":658,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102564':13A,16A '-2026':12A,15A '1.3.0':35B,93C 'action':105C 'addon':3A,25B,71C 'ae':64B,141C,146C 'allow':100C 'anywher':75C 'approv':171C 'arbitrari':47B,83C,126C 'attack':45B,51B,123C,153C,167C 'barrier':163C 'comment':10A,57B,66B,148C,155C,172C,175C 'cve':11A,14A 'due':96C 'dynif':2A,24B,70C 'elementor':5A,17B,27B,73C,76C 'execut':8A,85C,103C,125C 'exploit':53B,128C 'former':74C 'host':21B 'includ':33B,92C,144C 'let':43B 'make':118C 'moder':176C 'packag':18B 'page':60B,161C 'pass':36B 'plugin':29B,77C 'possibl':120C 'post':65B,137C,147C 'previous':170C 'proper':109C 'public':136C 'relax':178C 'remov':164C 'render':138C 'requir':129C 'run':46B,114C 'self':20B 'self-host':19B 'shortcod':7A,42B,49B,84C,116C,127C 'site':132C 'softwar':99C 'target':131C 'templat':142C 'unauthent':6A,44B,122C 'unvalid':38B 'use':62B 'user':101C 'valid':110C 'valu':39B,112C 'version':34B,88C 'visibl':158C 'vulner':81C 'widget':67B,149C 'wordpress':1A,22B,28B,48B,79C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Dynific Addons for Elementor plugin, version 1.3.0 or earlier, where a public post is rendered through an AE template that includes the AE Post Comments widget. Exploitation also requires the attacker's comment to appear on that page, which is easier when comments are pre-approved or moderation is relaxed. Sites without the plugin or without that widget can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-102564':13A,16A '-2026':12A,15A 'addon':3A 'comment':10A 'cve':11A,14A 'dynif':2A 'elementor':5A 'execut':8A 'shortcod':7A 'unauthent':6A 'wordpress':1A","search_b":"'1.3.0':35B 'addon':25B 'ae':64B 'arbitrari':47B 'attack':45B,51B 'comment':57B,66B 'dynif':24B 'elementor':17B,27B 'exploit':53B 'host':21B 'includ':33B 'let':43B 'packag':18B 'page':60B 'pass':36B 'plugin':29B 'post':65B 'run':46B 'self':20B 'self-host':19B 'shortcod':42B,49B 'unauthent':44B 'unvalid':38B 'use':62B 'valu':39B 'version':34B 'widget':67B 'wordpress':22B,28B,48B","search_c":"'1.3.0':93C 'action':105C 'addon':71C 'ae':141C,146C 'allow':100C 'anywher':75C 'approv':171C 'arbitrari':83C,126C 'attack':123C,153C,167C 'barrier':163C 'comment':148C,155C,172C,175C 'due':96C 'dynif':70C 'elementor':73C,76C 'execut':85C,103C,125C 'exploit':128C 'former':74C 'includ':92C,144C 'make':118C 'moder':176C 'page':161C 'plugin':77C 'possibl':120C 'post':137C,147C 'previous':170C 'proper':109C 'public':136C 'relax':178C 'remov':164C 'render':138C 'requir':129C 'run':114C 'shortcod':84C,116C,127C 'site':132C 'softwar':99C 'target':131C 'templat':142C 'unauthent':122C 'user':101C 'valid':110C 'valu':112C 'version':88C 'visibl':158C 'vulner':81C 'widget':149C 'wordpress':79C","first_public_at":"2026-11-07T12:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102564","severity":null,"published_at":"2026-11-07T12:17:40+00:00","modified_at":"2026-11-07T12:17:41+00:00","first_seen_at":"2026-11-07T12:47:07+00:00","fetched_at":"2026-11-07T12:47:07+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}