{"id":"CVE-2026-117523","kind":"vulnerability","aliases":["CVE-2026-117523"],"related":[],"title":"Dynific Addons for Elementor: any logged-in user can toggle site modules","description":"The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1's modules site-wide.","summary":"The Dynific Addons for Elementor WordPress plugin, before version 1.3.1, has an AJAX action that saves module settings without a capability or nonce check. Any logged-in user, including a Subscriber, can enable or disable the plugin's modules across the whole site.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["no-user-registration","plugin-at-1.3.1-or-later"],"how_to_check":"- Check the installed version of the Dynific Addons for Elementor (formerly Anywhere Elementor) plugin in the WordPress plugins list; versions below `1.3.1` are affected.\n- Review whether open registration allows Subscriber accounts on the site.","fix":"- Dynific Addons for Elementor (formerly Anywhere Elementor): update to `1.3.1` or later.","status":"open","published_at":"2026-11-11T06:17:14+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","triaged_at":"2026-11-11T06:27:49+00:00","updated_at":"2026-11-11T06:27:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:27:49Z","model":"claude-haiku-5-5","output":{"fix":"- Dynific Addons for Elementor (formerly Anywhere Elementor): update to `1.3.1` or later.","reach":"network","title":"Dynific Addons for Elementor: any logged-in user can toggle site modules","impact":"low","summary":"The Dynific Addons for Elementor WordPress plugin, before version 1.3.1, has an AJAX action that saves module settings without a capability or nonce check. Any logged-in user, including a Subscriber, can enable or disable the plugin's modules across the whole site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Any logged-in user can switch plugin modules on or off site-wide.","analyst_note":"","how_to_check":"- Check the installed version of the Dynific Addons for Elementor (formerly Anywhere Elementor) plugin in the WordPress plugins list; versions below `1.3.1` are affected.\n- Review whether open registration allows Subscriber accounts on the site.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-at-1.3.1-or-later","no-user-registration"],"who_is_affected":"WordPress sites running the Dynific Addons for Elementor plugin before 1.3.1 that allow logged-in users, including Subscriber accounts, are exposed. Sites without this plugin, or with it at 1.3.1 or later, are not affected. The flaw only changes module state, not data access.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000748,"input_tokens":4598,"output_tokens":577,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117523':16A,19A '-2026':15A,18A '1.3.1':35B,81C,120C 'across':66B 'action':39B,93C 'addon':2A,28B,72C,111C 'ajax':38B,92C 'allow':99C 'anywher':76C,115C 'authent':101C 'capabl':46B,86C 'check':49B,89C 'configur':98C 'cve':14A,17A 'disabl':61B,108C 'dynif':1A,27B,71C,110C 'elementor':4A,20B,30B,74C,77C,113C,116C 'enabl':59B,106C 'former':75C,114C 'host':24B 'includ':55B,103C 'log':7A,52B 'logged-in':6A,51B 'modul':13A,42B,65B,97C,122C 'nonc':48B,88C 'packag':21B 'perform':84C 'plugin':32B,63B,79C,118C 'save':41B,95C 'self':23B 'self-host':22B 'set':43B 'site':12A,69B,124C 'site-wid':123C 'subscrib':57B,104C 'toggl':11A 'user':9A,54B,102C 'version':34B 'whole':68B 'wide':125C 'without':44B 'wordpress':25B,31B,78C,117C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Dynific Addons for Elementor plugin before 1.3.1 that allow logged-in users, including Subscriber accounts, are exposed. Sites without this plugin, or with it at 1.3.1 or later, are not affected. The flaw only changes module state, not data access.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","low","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-117523':16A,19A '-2026':15A,18A 'addon':2A 'cve':14A,17A 'dynif':1A 'elementor':4A 'log':7A 'logged-in':6A 'modul':13A 'site':12A 'toggl':11A 'user':9A","search_b":"'1.3.1':35B 'across':66B 'action':39B 'addon':28B 'ajax':38B 'capabl':46B 'check':49B 'disabl':61B 'dynif':27B 'elementor':20B,30B 'enabl':59B 'host':24B 'includ':55B 'log':52B 'logged-in':51B 'modul':42B,65B 'nonc':48B 'packag':21B 'plugin':32B,63B 'save':41B 'self':23B 'self-host':22B 'set':43B 'site':69B 'subscrib':57B 'user':54B 'version':34B 'whole':68B 'without':44B 'wordpress':25B,31B","search_c":"'1.3.1':81C,120C 'action':93C 'addon':72C,111C 'ajax':92C 'allow':99C 'anywher':76C,115C 'authent':101C 'capabl':86C 'check':89C 'configur':98C 'disabl':108C 'dynif':71C,110C 'elementor':74C,77C,113C,116C 'enabl':106C 'former':75C,114C 'includ':103C 'modul':97C,122C 'nonc':88C 'perform':84C 'plugin':79C,118C 'save':95C 'site':124C 'site-wid':123C 'subscrib':104C 'user':102C 'wide':125C 'wordpress':78C,117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117523","severity":null,"published_at":"2026-11-11T06:17:14+00:00","modified_at":"2026-11-11T06:17:14+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","fetched_at":"2026-11-11T06:25:40+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}