AnyWhere Elementor <= 1.3.0 - Unauthenticated Sensitive Information Exposure via AJAX Lookup and Pagination Handlers
- ID
- WPSEC-2026-2199
- Plugin
- Dynific Addons for Elementor (formerly Anywhere Elementor) (anywhere-elementor)
- Affected
- all versions before 1.3.1
- Remediation
- Update to 1.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- AnyWhere Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.0 due to missing capability checks on the ae_term_data, ae_post_data and ae_repeater_data AJAX actions, which were registered for logged-out users and protected at most by a publicly printed nonce. The 'paged' fetch mode also rendered any widget from any caller-supplied post ID without checking the post's visibility. This makes it possible for unauthenticated attackers to retrieve terms from non-public taxonomies, titles of draft and private posts, ACF field values, and widget output from private or draft documents.
References
- https://wpsec.com/vuln/WPSEC-2026-2199/
- https://plugins.svn.wordpress.org/anywhere-elementor/tags/1.3.1/
- https://wordpress.org/plugins/anywhere-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS