{"id":"CVE-2026-119467","kind":"vulnerability","aliases":["CVE-2026-119467"],"related":[],"title":"WordPress AnyWhere Elementor plugin: missing authorization check exposes restricted actions","description":"Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.","summary":"AnyWhere Elementor, a WordPress plugin by WPVibes, lacks an authorization check, so access controls can be bypassed. The affected range runs through version 1.3.0 according to the NVD description.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["anywhere-elementor","elementor","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the AnyWhere Elementor plugin (`anywhere-elementor`) in the WordPress admin plugin list.","fix":null,"status":"open","published_at":"2026-11-07T09:17:12+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","triaged_at":"2026-11-07T09:47:55+00:00","updated_at":"2026-11-07T09:47:55+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T09:47:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress AnyWhere Elementor plugin: missing authorization check exposes restricted actions","impact":"medium","summary":"AnyWhere Elementor, a WordPress plugin by WPVibes, lacks an authorization check, so access controls can be bypassed. The affected range runs through version 1.3.0 according to the NVD description.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","anywhere-elementor"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may perform restricted plugin actions","analyst_note":"Check the NVD entry and the WPVibes or Wordfence advisory for the affected functions, required privileges and a fixed version.","how_to_check":"- Check the installed version of the AnyWhere Elementor plugin (`anywhere-elementor`) in the WordPress admin plugin list.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the AnyWhere Elementor WordPress plugin at version 1.3.0 or earlier. The sources do not say which actions are exposed or whether authentication is required, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000673,"input_tokens":4228,"output_tokens":500,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119467':13A,16A '-2026':12A,15A '1.3.0':46B,77C 'access':35B,66C 'accord':47B 'action':10A 'affect':41B,71C 'allow':62C 'anywher':2A,18B,23B,57C,60C,72C 'anywhere-elementor':17B,59C 'author':6A,32B,53C 'bypass':39B 'check':7A,33B 'configur':65C 'control':36B,67C 'cve':11A,14A 'descript':51B 'elementor':3A,19B,20B,24B,58C,61C,73C 'exploit':63C 'expos':8A 'incorrect':64C 'issu':70C 'lack':30B 'levels.this':69C 'miss':5A,52C 'n/a':75C 'nvd':50B 'packag':21B 'plugin':4A,27B 'rang':42B 'restrict':9A 'run':43B 'secur':68C 'version':45B 'vulner':54C 'wordpress':1A,22B,26B 'wpvibe':29B,56C","nicknames":[],"mitigations":[],"who_affected":"Sites running the AnyWhere Elementor WordPress plugin at version 1.3.0 or earlier. The sources do not say which actions are exposed or whether authentication is required, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["anywhereelementor","elementor","medium","package","wordpress"],"campaign_type":null,"search_a":"'-119467':13A,16A '-2026':12A,15A 'action':10A 'anywher':2A 'author':6A 'check':7A 'cve':11A,14A 'elementor':3A 'expos':8A 'miss':5A 'plugin':4A 'restrict':9A 'wordpress':1A","search_b":"'1.3.0':46B 'access':35B 'accord':47B 'affect':41B 'anywher':18B,23B 'anywhere-elementor':17B 'author':32B 'bypass':39B 'check':33B 'control':36B 'descript':51B 'elementor':19B,20B,24B 'lack':30B 'nvd':50B 'packag':21B 'plugin':27B 'rang':42B 'run':43B 'version':45B 'wordpress':22B,26B 'wpvibe':29B","search_c":"'1.3.0':77C 'access':66C 'affect':71C 'allow':62C 'anywher':57C,60C,72C 'anywhere-elementor':59C 'author':53C 'configur':65C 'control':67C 'elementor':58C,61C,73C 'exploit':63C 'incorrect':64C 'issu':70C 'levels.this':69C 'miss':52C 'n/a':75C 'secur':68C 'vulner':54C 'wpvibe':56C","first_public_at":"2026-11-07T09:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119467","severity":null,"published_at":"2026-11-07T09:17:12+00:00","modified_at":"2026-11-07T09:17:12+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","fetched_at":"2026-11-07T09:46:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}