{"id":"CVE-2026-114187","kind":"vulnerability","aliases":["CVE-2026-114187"],"related":[],"title":"WordPress AnyWhere Elementor plugin: missing authorization check through version 1.3.0","description":"Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.","summary":"The AnyWhere Elementor WordPress plugin is missing an authorization check, so access-control settings can be exploited when they are incorrectly configured. The sources do not say what an attacker can read or change beyond that.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["anywhere-elementor","elementor","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Look for the `anywhere-elementor` plugin in the WordPress plugins list and check its version.","fix":"- `AnyWhere Elementor` fixed version: unknown (the sources only state affected versions through `1.3.0`)","status":"open","published_at":"2026-11-03T17:17:54+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","triaged_at":"2026-11-03T17:24:30+00:00","updated_at":"2026-11-03T17:24:30+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-03T17:24:30Z","model":"claude-haiku-5-5","output":{"fix":"- `AnyWhere Elementor` fixed version: unknown (the sources only state affected versions through `1.3.0`)","reach":"internet","title":"WordPress AnyWhere Elementor plugin: missing authorization check through version 1.3.0","impact":"medium","summary":"The AnyWhere Elementor WordPress plugin is missing an authorization check, so access-control settings can be exploited when they are incorrectly configured. The sources do not say what an attacker can read or change beyond that.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","elementor","anywhere-elementor"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access-control bypass on affected WordPress sites","analyst_note":"Check the NVD entry and the WPVibes or WordPress plugin advisory for the fixed version and the exact access-control flaw.","how_to_check":"- Look for the `anywhere-elementor` plugin in the WordPress plugins list and check its version.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the AnyWhere Elementor plugin at version 1.3.0 or earlier are affected, according to the sources. The sources do not describe the exact configuration needed for exploitation. Sites without this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":4128,"output_tokens":529,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114187':13A,16A '-2026':12A,15A '1.3.0':10A,84C 'access':35B,73C 'access-control':34B 'affect':78C 'allow':69C 'anywher':2A,18B,24B,64C,67C,79C 'anywhere-elementor':17B,66C 'attack':53B 'author':6A,31B,60C 'beyond':58B 'chang':57B 'check':7A,32B 'configur':45B,72C 'control':36B,74C 'cve':11A,14A 'elementor':3A,19B,20B,25B,65C,68C,80C 'exploit':40B,70C 'incorrect':44B,71C 'issu':77C 'levels.this':76C 'miss':5A,29B,59C 'n/a':82C 'plugin':4A,27B 'read':55B 'say':50B 'secur':75C 'set':37B 'sourc':47B 'version':9A 'vulner':61C 'wordpress':1A,22B,26B 'wpvibe':63C","nicknames":[],"mitigations":[],"who_affected":"Sites running the AnyWhere Elementor plugin at version 1.3.0 or earlier are affected, according to the sources. The sources do not describe the exact configuration needed for exploitation. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["anywhereelementor","elementor","medium","other","wordpress"],"first_public_at":"2026-11-03T17:17:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114187","severity":null,"published_at":"2026-11-03T17:17:54+00:00","modified_at":"2026-11-03T17:17:54+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","fetched_at":"2026-11-03T17:21:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}