CVE-2026-117523 · Package
NO FIX YET · SEE WHAT TO DO
The Dynific Addons for Elementor WordPress plugin, before version 1.3.1, has an AJAX action that saves module settings without a capability or nonce check. Any logged-in user, including a Subscriber, can enable or disable the plugin's modules across the whole site.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
WordPress sites running the Dynific Addons for Elementor plugin before 1.3.1 that allow logged-in users, including Subscriber accounts, are exposed. Sites without this plugin, or with it at 1.3.1 or later, are not affected. The flaw only changes module state, not data access.
Not affected if no-user-registration, plugin-at-1.3.1-or-later
Who cares elementor, self-hosted, wordpress
1.3.1 are affected.1.3.1 or later.The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1's modules site-wide.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.