CVE-2026-114189: WordPress AnyWhere Elementor plugin <= 1.3.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress AnyWhere Elementorto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability can be exploited remotely with low privileges and does not require user interaction. The provided vector indicates the attacker must have an authenticated account with low-level permissions.
Which installations are affected?
AnyWhere Elementor versions through 1.3.0 are affected. The available information does not state whether a default WordPress or plugin configuration is required.
What could successful exploitation impact?
Successful exploitation may expose highly sensitive information and cause a low availability impact. The vector indicates no direct integrity impact, while the scope may extend beyond the vulnerable component.