Vulnerabilities / AnyWhere Elementor / WPSEC-2026-2196
AnyWhere Elementor <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comments
High 7.3
CWE-94Fixed in 1.3.1
- ID
- WPSEC-2026-2196
- Plugin
- Dynific Addons for Elementor (formerly Anywhere Elementor) (anywhere-elementor)
- Affected
- all versions before 1.3.1
- Remediation
- Update to 1.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- AnyWhere Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to arbitrary shortcode execution via comments in all versions up to, and including, 1.3.0. This is due to render_insert_elementor() running do_shortcode() over the entire rendered template output, which includes comment text printed by the Post Comments widget. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by posting a comment on a post displayed with a template, for example to render the content of other posts.
References
- https://wpsec.com/vuln/WPSEC-2026-2196/
- https://plugins.svn.wordpress.org/anywhere-elementor/tags/1.3.1/
- https://wordpress.org/plugins/anywhere-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS