Live › vulnerability › CVE-2026-114187
The AnyWhere Elementor WordPress plugin is missing an authorization check, so access-control settings can be exploited when they are incorrectly configured. The sources do not say what an attacker can read or change beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Sites running the AnyWhere Elementor plugin at version 1.3.0 or earlier are affected, according to the sources. The sources do not describe the exact configuration needed for exploitation. Sites without this plugin can skip it.
No product ranges from the sources yet.
anywhere-elementor plugin in the WordPress plugins list and check its version.AnyWhere Elementor fixed version: unknown (the sources only state affected versions through 1.3.0)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114187")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.