---
id: "CVE-2026-117524"
page: "https://infrastack.ai/live/CVE-2026-117524"
kind: "vulnerability"
aliases: ["CVE-2026-117524"]
title: "WordPress Dynific Addons for Elementor: contributors can read others' private posts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-contributor-accounts", "plugin-1.3.1-or-later"]
published_at: "2026-11-11T06:17:14+00:00"
first_seen_at: "2026-11-11T06:25:40+00:00"
updated_at: "2026-11-11T06:27:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117524", "first_seen_at": "2026-11-11T06:25:40+00:00"}]
exploit_sources: []
---

# WordPress Dynific Addons for Elementor: contributors can read others' private posts

Link for people: https://infrastack.ai/live/CVE-2026-117524 (this .md is for agents)

The Dynific Addons for Elementor WordPress plugin, before version 1.3.1, skips status and capability checks when resolving post IDs in one of its shortcodes. A logged-in user with Contributor role or higher can read drafts, private and password-protected posts written by other users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Dynific Addons for Elementor (formerly Anywhere Elementor) plugin in the WordPress admin plugin list; `1.3.1` or later is not affected.
- Look for the plugin's shortcodes in posts that contain draft, private or password-protected content.

## Fix

- Dynific Addons for Elementor (formerly Anywhere Elementor): move to `1.3.1` or later.

## Timeline

- 2026-11-11T06:25:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117524

## From the sources

The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status or capability check when resolving post identifiers passed to one of its shortcodes, allowing authenticated users with at least the Contributor role to disclose the content of other users' draft, private and password-protected posts. An Author can republish that content to anonymous visitors.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_