Missing Authorization Vulnerability in WPVibes AnyWhere Elementor Plugin
CVE-2026-114187

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Anywhere Elementor
Vendor
CVE Published:
3 November 2026

What is CVE-2026-114187?

The WPVibes AnyWhere Elementor plugin for WordPress has a missing authorization vulnerability that allows attackers to exploit improperly configured access control mechanisms. This flaw enables unauthorized users to access restricted functionalities within the plugin, potentially compromising website integrity and user data. Affected versions include AnyWhere Elementor from n/a up to 1.3.0. It's crucial for users and website administrators to update the plugin to mitigate these security risks.

Affected Version(s)

AnyWhere Elementor 0 <= 1.3.0

References

https://patchstack.com/database/wordpress/plugin/anywhere...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

yottt | Patchstack Bug Bounty Program
.