{"id":"CVE-2026-117524","kind":"vulnerability","aliases":["CVE-2026-117524"],"related":[],"title":"WordPress Dynific Addons for Elementor: contributors can read others' private posts","description":"The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status or capability check when resolving post identifiers passed to one of its shortcodes, allowing authenticated users with at least the Contributor role to disclose the content of other users' draft, private and password-protected posts. An Author can republish that content to anonymous visitors.","summary":"The Dynific Addons for Elementor WordPress plugin, before version 1.3.1, skips status and capability checks when resolving post IDs in one of its shortcodes. A logged-in user with Contributor role or higher can read drafts, private and password-protected posts written by other users.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-1.3.1-or-later"],"how_to_check":"- Check the installed version of the Dynific Addons for Elementor (formerly Anywhere Elementor) plugin in the WordPress admin plugin list; `1.3.1` or later is not affected.\n- Look for the plugin's shortcodes in posts that contain draft, private or password-protected content.","fix":"- Dynific Addons for Elementor (formerly Anywhere Elementor): move to `1.3.1` or later.","status":"open","published_at":"2026-11-11T06:17:14+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","triaged_at":"2026-11-11T06:27:47+00:00","updated_at":"2026-11-11T06:27:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:27:47Z","model":"claude-haiku-5-5","output":{"fix":"- Dynific Addons for Elementor (formerly Anywhere Elementor): move to `1.3.1` or later.","reach":"internet","title":"WordPress Dynific Addons for Elementor: contributors can read others' private posts","impact":"medium","summary":"The Dynific Addons for Elementor WordPress plugin, before version 1.3.1, skips status and capability checks when resolving post IDs in one of its shortcodes. A logged-in user with Contributor role or higher can read drafts, private and password-protected posts written by other users.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"contributor reads other users' private and draft posts","analyst_note":"","how_to_check":"- Check the installed version of the Dynific Addons for Elementor (formerly Anywhere Elementor) plugin in the WordPress admin plugin list; `1.3.1` or later is not affected.\n- Look for the plugin's shortcodes in posts that contain draft, private or password-protected content.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-1.3.1-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 with contributor-level or higher accounts are exposed, since those users can trigger the flawed shortcode. Sites without the plugin, or with it at 1.3.1 or later, are not affected. Sites with only trusted administrators and no untrusted contributor accounts carry little practical risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000772,"input_tokens":4585,"output_tokens":628,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117524':14A,17A '-2026':13A,16A '1.3.1':33B,82C 'addon':3A,26B,73C 'allow':101C 'anonym':131C 'anywher':77C 'authent':102C 'author':125C 'capabl':37B,89C 'check':38B,90C 'content':113C,129C 'contributor':6A,54B,108C 'cve':12A,15A 'disclos':111C 'draft':60B,117C 'dynif':2A,25B,72C 'elementor':5A,18B,28B,75C,78C 'former':76C 'higher':57B 'host':22B 'id':42B 'identifi':94C 'least':106C 'log':50B 'logged-in':49B 'one':44B,97C 'other':9A 'packag':19B 'pass':95C 'password':64B,121C 'password-protect':63B,120C 'perform':85C 'plugin':30B,80C 'post':11A,41B,66B,93C,123C 'privat':10A,61B,118C 'protect':65B,122C 'read':8A,59B 'republish':127C 'resolv':40B,92C 'role':55B,109C 'self':21B 'self-host':20B 'shortcod':47B,100C 'skip':34B 'status':35B,87C 'user':52B,70B,103C,116C 'version':32B 'visitor':132C 'wordpress':1A,23B,29B,79C 'written':67B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 with contributor-level or higher accounts are exposed, since those users can trigger the flawed shortcode. Sites without the plugin, or with it at 1.3.1 or later, are not affected. Sites with only trusted administrators and no untrusted contributor accounts carry little practical risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-117524':14A,17A '-2026':13A,16A 'addon':3A 'contributor':6A 'cve':12A,15A 'dynif':2A 'elementor':5A 'other':9A 'post':11A 'privat':10A 'read':8A 'wordpress':1A","search_b":"'1.3.1':33B 'addon':26B 'capabl':37B 'check':38B 'contributor':54B 'draft':60B 'dynif':25B 'elementor':18B,28B 'higher':57B 'host':22B 'id':42B 'log':50B 'logged-in':49B 'one':44B 'packag':19B 'password':64B 'password-protect':63B 'plugin':30B 'post':41B,66B 'privat':61B 'protect':65B 'read':59B 'resolv':40B 'role':55B 'self':21B 'self-host':20B 'shortcod':47B 'skip':34B 'status':35B 'user':52B,70B 'version':32B 'wordpress':23B,29B 'written':67B","search_c":"'1.3.1':82C 'addon':73C 'allow':101C 'anonym':131C 'anywher':77C 'authent':102C 'author':125C 'capabl':89C 'check':90C 'content':113C,129C 'contributor':108C 'disclos':111C 'draft':117C 'dynif':72C 'elementor':75C,78C 'former':76C 'identifi':94C 'least':106C 'one':97C 'pass':95C 'password':121C 'password-protect':120C 'perform':85C 'plugin':80C 'post':93C,123C 'privat':118C 'protect':122C 'republish':127C 'resolv':92C 'role':109C 'shortcod':100C 'status':87C 'user':103C,116C 'visitor':132C 'wordpress':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117524","severity":null,"published_at":"2026-11-11T06:17:14+00:00","modified_at":"2026-11-11T06:17:14+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","fetched_at":"2026-11-11T06:25:40+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}