SQL Injection Vulnerability in WPVibes AnyWhere Elementor Plugin
CVE-2026-114189

8.5HIGH

Key Information:

Vendor

WordPress
Status
Anywhere Elementor
Vendor
CVE Published:
8 November 2026

What is CVE-2026-114189?

The WPVibes AnyWhere Elementor plugin for WordPress is susceptible to an SQL Injection vulnerability, specifically allowing for blind SQL injection. This issue can potentially allow unauthorized access to database contents, enabling an attacker to manipulate queries executed by the application. Users of AnyWhere Elementor versions up to 1.3.0 are urged to update their installations to mitigate this risk effectively.

Affected Version(s)

AnyWhere Elementor 0 <= 1.3.0

References

https://patchstack.com/database/wordpress/plugin/anywhere...
vdb-entry

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

yottt | Patchstack Bug Bounty Program
.