{"id":"CVE-2026-114186","kind":"vulnerability","aliases":["CVE-2026-114186"],"related":[],"title":"WordPress AnyWhere Elementor plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.","summary":"The AnyWhere Elementor WordPress plugin lacks an authorization check, so access control settings can be exploited when they are misconfigured. The sources do not say exactly which actions an attacker can take.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["anywhere-elementor","elementor","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `anywhere-elementor` plugin is installed and its version in the WordPress admin under Plugins.\n- Compare the installed version against `1.3.0`, the last affected version named in the sources.","fix":null,"status":"open","published_at":"2026-11-08T16:16:36+00:00","first_seen_at":"2026-11-08T16:18:34+00:00","triaged_at":"2026-11-08T16:18:55+00:00","updated_at":"2026-11-08T16:18:55+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-08T16:18:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"WordPress AnyWhere Elementor plugin: missing authorization check exposes access controls","impact":"medium","summary":"The AnyWhere Elementor WordPress plugin lacks an authorization check, so access control settings can be exploited when they are misconfigured. The sources do not say exactly which actions an attacker can take.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","anywhere-elementor"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown: attacker may bypass access controls on the site","analyst_note":"Check the NVD entry and the WPVibes or WordPress plugin advisory for the affected action, required privilege, and a fixed version.","how_to_check":"- Check whether the `anywhere-elementor` plugin is installed and its version in the WordPress admin under Plugins.\n- Compare the installed version against `1.3.0`, the last affected version named in the sources.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the AnyWhere Elementor plugin (anywhere-elementor) at version 1.3.0 or earlier, per the sources. Sites without the plugin are not affected. The sources do not say which access control settings are involved or whether a default configuration is exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000721,"input_tokens":4556,"output_tokens":530,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114186':13A,16A '-2026':12A,15A '1.3.0':80C 'access':9A,33B,69C 'action':50B 'affect':74C 'allow':65C 'anywher':2A,18B,24B,60C,63C,75C 'anywhere-elementor':17B,62C 'attack':52B 'author':6A,30B,56C 'check':7A,31B 'configur':68C 'control':10A,34B,70C 'cve':11A,14A 'elementor':3A,19B,20B,25B,61C,64C,76C 'exact':48B 'exploit':38B,66C 'expos':8A 'incorrect':67C 'issu':73C 'lack':28B 'levels.this':72C 'misconfigur':42B 'miss':5A,55C 'n/a':78C 'packag':21B 'plugin':4A,27B 'say':47B 'secur':71C 'set':35B 'sourc':44B 'take':54B 'vulner':57C 'wordpress':1A,22B,26B 'wpvibe':59C","nicknames":[],"mitigations":[],"who_affected":"Sites running the AnyWhere Elementor plugin (anywhere-elementor) at version 1.3.0 or earlier, per the sources. Sites without the plugin are not affected. The sources do not say which access control settings are involved or whether a default configuration is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["anywhereelementor","elementor","medium","package","wordpress"],"campaign_type":null,"search_a":"'-114186':13A,16A '-2026':12A,15A 'access':9A 'anywher':2A 'author':6A 'check':7A 'control':10A 'cve':11A,14A 'elementor':3A 'expos':8A 'miss':5A 'plugin':4A 'wordpress':1A","search_b":"'access':33B 'action':50B 'anywher':18B,24B 'anywhere-elementor':17B 'attack':52B 'author':30B 'check':31B 'control':34B 'elementor':19B,20B,25B 'exact':48B 'exploit':38B 'lack':28B 'misconfigur':42B 'packag':21B 'plugin':27B 'say':47B 'set':35B 'sourc':44B 'take':54B 'wordpress':22B,26B","search_c":"'1.3.0':80C 'access':69C 'affect':74C 'allow':65C 'anywher':60C,63C,75C 'anywhere-elementor':62C 'author':56C 'configur':68C 'control':70C 'elementor':61C,64C,76C 'exploit':66C 'incorrect':67C 'issu':73C 'levels.this':72C 'miss':55C 'n/a':78C 'secur':71C 'vulner':57C 'wpvibe':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T16:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114186","severity":null,"published_at":"2026-11-08T16:16:36+00:00","modified_at":"2026-11-08T16:16:37+00:00","first_seen_at":"2026-11-08T16:18:34+00:00","fetched_at":"2026-11-08T16:18:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}