---
id: "CVE-2026-114189"
page: "https://infrastack.ai/live/CVE-2026-114189"
kind: "vulnerability"
aliases: ["CVE-2026-114189"]
title: "WordPress AnyWhere Elementor plugin: blind SQL injection through version 1.3.0"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "anywhere-elementor", "fixed": ["1.3.1"], "affected": "<= 1.3.0", "ecosystem": "wordpress-plugin"}]
ecosystems: []
tags: ["auth-required", "elementor", "package", "sql-injection", "wordpress", "wp-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-08T16:16:37+00:00"
first_seen_at: "2026-11-08T16:18:34+00:00"
updated_at: "2026-11-08T16:19:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114189", "first_seen_at": "2026-11-08T16:18:34+00:00"}, {"source": "analyst", "url": "https://wpsec.com/vuln/WPSEC-2026-2200/", "first_seen_at": "2026-11-08T16:19:51+00:00", "cites": ["https://wpsec.com/vuln/WPSEC-2026-2200/", "https://wordpress.org/plugins/anywhere-elementor/"]}]
exploit_sources: []
---

# WordPress AnyWhere Elementor plugin: blind SQL injection through version 1.3.0

Link for people: https://infrastack.ai/live/CVE-2026-114189 (this .md is for agents)

The WPVibes AnyWhere Elementor plugin for WordPress does not neutralize input used in an SQL query, enabling blind SQL injection. An attacker can read data from the site's database one inferred bit at a time.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-plugin:anywhere-elementor affected <= 1.3.0 fixed 1.3.1

## How to check

In wp-admin > Plugins, look for 'Dynific Addons for Elementor (formerly Anywhere Elementor)' (folder wp-content/plugins/anywhere-elementor). Version 1.3.0 or lower is affected; 1.3.1 or later is fixed. With WP-CLI: wp plugin get anywhere-elementor --field=version

## Fix

Update the plugin (now called Dynific Addons for Elementor, slug anywhere-elementor) to 1.3.1 or later. The vendor changelog for 1.3.1 says only 'Fix: Security Issues'; the SQL injection fix is named in WPSec and Patchstack.

## Timeline

- 2026-11-08T16:18:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114189
- 2026-11-08T16:19:51+00:00 analyst https://wpsec.com/vuln/WPSEC-2026-2200/ — NVD (Patchstack-assigned CVE-2026-114189) gives no endpoint. WPSec WPSEC-2026-2200 (third party) describes the 'q' param SQLi in ae_prev_post, fixed in 1.3.1; Wordfence lists it as CVE-2026-103914. I could not confirm that WPSec's entry is the same issue as this CVE, so the match is likely but unconfirmed. Vendor changelog 1.3.1 says only 'Fix: Security Issues' (released 2026-11-02), so nothing marked verified. No exploitation or PoC found. Same release fixed several sibling CVEs (114183, 114187, 114185).

## Documents

- [describes] WPSEC-2026-2200 AnyWhere Elementor <= 1.3.0 Subscriber+ SQL Injection via 'q' https://wpsec.com/vuln/WPSEC-2026-2200/
- [fix] Dynific Addons for Elementor (formerly Anywhere Elementor) - WordPress.org, changelog 1.3.1 https://wordpress.org/plugins/anywhere-elementor/

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_