---
id: "CVE-2026-117523"
page: "https://infrastack.ai/live/CVE-2026-117523"
kind: "vulnerability"
aliases: ["CVE-2026-117523"]
title: "Dynific Addons for Elementor: any logged-in user can toggle site modules"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-user-registration", "plugin-at-1.3.1-or-later"]
published_at: "2026-11-11T06:17:14+00:00"
first_seen_at: "2026-11-11T06:25:40+00:00"
updated_at: "2026-11-11T06:27:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117523", "first_seen_at": "2026-11-11T06:25:40+00:00"}]
exploit_sources: []
---

# Dynific Addons for Elementor: any logged-in user can toggle site modules

Link for people: https://infrastack.ai/live/CVE-2026-117523 (this .md is for agents)

The Dynific Addons for Elementor WordPress plugin, before version 1.3.1, has an AJAX action that saves module settings without a capability or nonce check. Any logged-in user, including a Subscriber, can enable or disable the plugin's modules across the whole site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Dynific Addons for Elementor (formerly Anywhere Elementor) plugin in the WordPress plugins list; versions below `1.3.1` are affected.
- Review whether open registration allows Subscriber accounts on the site.

## Fix

- Dynific Addons for Elementor (formerly Anywhere Elementor): update to `1.3.1` or later.

## Timeline

- 2026-11-11T06:25:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117523

## From the sources

The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1's modules site-wide.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_