CVE-2026-117523: Dynific Addons for Elementor < 1.3.1 - Subscriber+ Module Settings Update via aep_module AJAX Action
The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1's modules site-wide.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dynific Addons for Elementorto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can exploit it, including users with the Subscriber role. No elevated WordPress capability is required according to the available information.
What access does an attacker need?
The attacker needs a valid authenticated account on the affected WordPress site. The issue is exposed through the aep_module AJAX action.
Are default low-privilege accounts affected?
Yes. Subscriber accounts are specifically identified as able to enable or disable the plugin's modules site-wide.
How can I determine whether my site is vulnerable?
Check whether Dynific Addons for Elementor is installed and running a version earlier than 1.3.1. Sites where untrusted or low-privilege users can authenticate have the relevant exposure.
What is the immediate remediation?
Update the plugin to version 1.3.1 or later. If updating cannot happen immediately, restrict or remove untrusted authenticated accounts, particularly Subscriber-level accounts, to reduce exploitation opportunities.