---
id: "CVE-2026-114186"
page: "https://infrastack.ai/live/CVE-2026-114186"
kind: "vulnerability"
aliases: ["CVE-2026-114186"]
title: "WordPress AnyWhere Elementor plugin: missing authorization check exposes access controls"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["anywhere-elementor", "elementor", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-08T16:16:36+00:00"
first_seen_at: "2026-11-08T16:18:34+00:00"
updated_at: "2026-11-08T16:18:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114186", "first_seen_at": "2026-11-08T16:18:34+00:00"}]
exploit_sources: []
---

# WordPress AnyWhere Elementor plugin: missing authorization check exposes access controls

Link for people: https://infrastack.ai/live/CVE-2026-114186 (this .md is for agents)

The AnyWhere Elementor WordPress plugin lacks an authorization check, so access control settings can be exploited when they are misconfigured. The sources do not say exactly which actions an attacker can take.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `anywhere-elementor` plugin is installed and its version in the WordPress admin under Plugins.
- Compare the installed version against `1.3.0`, the last affected version named in the sources.

## Timeline

- 2026-11-08T16:18:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114186

## From the sources

Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_