CVE-2026-117524: Dynific Addons for Elementor 1.3 - Contributor+ Arbitrary Post Content Disclosure via dynific_template Shortcode
The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status or capability check when resolving post identifiers passed to one of its shortcodes, allowing authenticated users with at least the Contributor role to disclose the content of other users' draft, private and password-protected posts. An Author can republish that content to anonymous visitors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dynific Addons for Elementorto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with at least the Contributor role can exploit the affected shortcode behavior. The issue is not described as exploitable by unauthenticated visitors directly.
What content could be exposed?
A Contributor or higher can disclose the contents of other users' draft, private, and password-protected posts by supplying their identifiers to the affected shortcode.
Can the disclosed content be made public?
Yes. An Author can republish disclosed content so that anonymous visitors can access it.
Which installations are affected?
Dynific Addons for Elementor versions before 1.3.1 are affected. The description does not identify any configuration requirement beyond use of the vulnerable shortcode.