Arbitrary Shortcode Execution Vulnerability in Dynific Addons for Elementor Plugin

CVE-2026-102564

What is CVE-2026-102564?

The Dynific Addons for Elementor plugin, previously known as Anywhere Elementor, is susceptible to arbitrary shortcode execution in all versions up to and including 1.3.0. This vulnerability arises because the plugin permits users to perform an action that lacks proper validation before executing do_shortcode. As a result, unauthorized attackers can run arbitrary shortcodes. Successful exploitation necessitates that the target WordPress site displays a public post using an AE template that integrates the AE Post Comments widget, and the attacker's comment must be visible on that page. This barrier can be bypassed if the attacker’s comment has prior approval or if comment moderation is not enforced.

References