{"id":"CVE-2026-114189","kind":"vulnerability","aliases":["CVE-2026-114189"],"related":[],"title":"WordPress AnyWhere Elementor plugin: blind SQL injection through version 1.3.0","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0.","summary":"The WPVibes AnyWhere Elementor plugin for WordPress does not neutralize input used in an SQL query, enabling blind SQL injection. An attacker can read data from the site's database one inferred bit at a time.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"anywhere-elementor","fixed":["1.3.1"],"affected":"<= 1.3.0","ecosystem":"wordpress-plugin"}],"ecosystems":[],"tags":["auth-required","elementor","package","sql-injection","wordpress","wp-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In wp-admin > Plugins, look for 'Dynific Addons for Elementor (formerly Anywhere Elementor)' (folder wp-content/plugins/anywhere-elementor). Version 1.3.0 or lower is affected; 1.3.1 or later is fixed. With WP-CLI: wp plugin get anywhere-elementor --field=version","fix":"Update the plugin (now called Dynific Addons for Elementor, slug anywhere-elementor) to 1.3.1 or later. The vendor changelog for 1.3.1 says only 'Fix: Security Issues'; the SQL injection fix is named in WPSec and Patchstack.","status":"open","published_at":"2026-11-08T16:16:37+00:00","first_seen_at":"2026-11-08T16:18:34+00:00","triaged_at":"2026-11-08T16:18:51+00:00","updated_at":"2026-11-08T16:19:51+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-08T16:18:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress AnyWhere Elementor plugin: blind SQL injection through version 1.3.0","impact":"high","summary":"The WPVibes AnyWhere Elementor plugin for WordPress does not neutralize input used in an SQL query, enabling blind SQL injection. An attacker can read data from the site's database one inferred bit at a time.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin","elementor"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"database contents readable by an attacker through blind injection","analyst_note":"Find the vulnerable endpoint, the authentication requirement, and whether a fixed version after 1.3.0 exists, from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114189 or the WPVibes or WordPress plugin pages.","how_to_check":"- Check whether the `anywhere-elementor` plugin is installed on the WordPress site, in the plugins list or `wp-content/plugins/anywhere-elementor`.\n- Check the installed plugin version against `1.3.0`; the sources say versions through `1.3.0` are affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WPVibes AnyWhere Elementor WordPress plugin, in the versions the sources list as affected. The sources do not say which endpoint or setting makes it reachable, so the exposure of a site without the plugin is none, and the exposure of a site with it is unknown beyond the plugin version.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000776,"input_tokens":4558,"output_tokens":640,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vulnerable endpoint, the authentication requirement, and whether a fixed version after 1.3.0 exists, from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114189 or the WPVibes or WordPress plugin pages.","search":"'-114189':13A,16A '-2026':12A,15A '1.3.0':10A,99C 'affect':93C 'allow':88C 'anywher':2A,34B,83C,86C,94C 'anywhere':18A 'anywhere-elementor':17A,85C 'attack':53B 'auth':21B 'auth-requir':20B 'bit':64B 'blind':5A,49B,89C 'command':77C 'cve':11A,14A 'data':56B 'databas':61B 'element':72C 'elementor':3A,19A,23B,35B,84C,87C,95C 'enabl':48B 'improp':68C 'infer':63B 'inject':7A,27B,51B,79C 'injection.this':91C 'input':42B 'issu':92C 'n/a':97C 'neutral':41B,69C 'one':62B 'packag':24B 'plugin':4A,31B,36B 'queri':47B 'read':55B 'requir':22B 'site':59B 'special':71C 'sql':6A,26B,46B,50B,76C,78C,90C 'sql-inject':25B 'time':67B 'use':43B,73C 'version':9A 'vulner':80C 'wordpress':1A,28B,38B 'wp':30B 'wp-plugin':29B 'wpvibe':33B,82C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Dynific Addons for Elementor (formerly AnyWhere Elementor) plugin at version 1.3.0 or lower. WPSec describes the flaw as SQL injection via the 'q' parameter of the ae_prev_post AJAX action. The nonce it checks is printed to every front-end visitor and there is no capability check. WPSec labels it Subscriber+, so a site that lets visitors register is more exposed. Sites without the plugin, or on 1.3.1 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["anywhereelementor"],"ptokens":["anywhere","elementor"],"labels":["authrequired","elementor","high","package","sqlinjection","wordpress","wpplugin"],"campaign_type":null,"search_a":"'-114189':13A,16A '-2026':12A,15A '1.3.0':10A 'anywher':2A 'anywhere':18A 'anywhere-elementor':17A 'blind':5A 'cve':11A,14A 'elementor':3A,19A 'inject':7A 'plugin':4A 'sql':6A 'version':9A 'wordpress':1A","search_b":"'anywher':34B 'attack':53B 'auth':21B 'auth-requir':20B 'bit':64B 'blind':49B 'data':56B 'databas':61B 'elementor':23B,35B 'enabl':48B 'infer':63B 'inject':27B,51B 'input':42B 'neutral':41B 'one':62B 'packag':24B 'plugin':31B,36B 'queri':47B 'read':55B 'requir':22B 'site':59B 'sql':26B,46B,50B 'sql-inject':25B 'time':67B 'use':43B 'wordpress':28B,38B 'wp':30B 'wp-plugin':29B 'wpvibe':33B","search_c":"'1.3.0':99C 'affect':93C 'allow':88C 'anywher':83C,86C,94C 'anywhere-elementor':85C 'blind':89C 'command':77C 'element':72C 'elementor':84C,87C,95C 'improp':68C 'inject':79C 'injection.this':91C 'issu':92C 'n/a':97C 'neutral':69C 'special':71C 'sql':76C,78C,90C 'use':73C 'vulner':80C 'wpvibe':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T16:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114189","severity":null,"published_at":"2026-11-08T16:16:37+00:00","modified_at":"2026-11-08T16:16:37+00:00","first_seen_at":"2026-11-08T16:18:34+00:00","fetched_at":"2026-11-08T16:18:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114189:2190","url":"https://wordpress.org/plugins/anywhere-elementor/","severity":null,"published_at":"2026-11-08T16:19:51+00:00","modified_at":"2026-11-08T16:19:51+00:00","first_seen_at":"2026-11-08T16:19:51+00:00","fetched_at":"2026-11-08T16:19:51+00:00","note":"NVD (Patchstack-assigned CVE-2026-114189) gives no endpoint. WPSec WPSEC-2026-2200 (third party) describes the 'q' param SQLi in ae_prev_post, fixed in 1.3.1; Wordfence lists it as CVE-2026-103914. I could not confirm that WPSec's entry is the same issue as this CVE, so the match is likely but unconfirmed. Vendor changelog 1.3.1 says only 'Fix: Security Issues' (released 2026-11-02), so nothing marked verified. No exploitation or PoC found. Same release fixed several sibling CVEs (114183, 114187, 114185).","cites":["https://wordpress.org/plugins/anywhere-elementor/","https://wpsec.com/vuln/WPSEC-2026-2200/"]}],"documents":[{"id":102486,"url":"https://wordpress.org/plugins/anywhere-elementor/","title":"Dynific Addons for Elementor (formerly Anywhere Elementor) - WordPress.org, changelog 1.3.1","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":102487,"url":"https://wpsec.com/vuln/WPSEC-2026-2200/","title":"WPSEC-2026-2200 AnyWhere Elementor <= 1.3.0 Subscriber+ SQL Injection via 'q'","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}