CVE-2026-119467: WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability

Q: Which installations are affected?

The issue affects WPVibes AnyWhere Elementor versions through 1.3.0. The available data does not identify a fixed version.

Q: What access does an attacker need to exploit this issue?

The available information identifies missing authorization and incorrectly configured access-control levels, but does not state the attacker’s required authentication level or prerequisites.

Q: Are default plugin configurations affected?

The available data does not say whether exploitation requires a non-default configuration or whether default installations are affected.

Q: How can administrators determine whether they are exposed?

Confirm whether AnyWhere Elementor is installed and whether its version is 1.3.0 or earlier. The provided information does not include indicators of compromise, affected endpoints, or specific configuration checks.

Published Nov 7, 2026

Updated

Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade anywhere-elementor to a version that resolves this vulnerability.
Fixed in 1.3.1

Event History

Nov 7, 2026

CVE Published

via MITRE·09:02 AM

Data Sourced

via MITRE·09:02 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The issue affects WPVibes AnyWhere Elementor versions through 1.3.0. The available data does not identify a fixed version.

What access does an attacker need to exploit this issue?

The available information identifies missing authorization and incorrectly configured access-control levels, but does not state the attacker’s required authentication level or prerequisites.

Are default plugin configurations affected?

The available data does not say whether exploitation requires a non-default configuration or whether default installations are affected.

How can administrators determine whether they are exposed?

Confirm whether AnyWhere Elementor is installed and whether its version is 1.3.0 or earlier. The provided information does not include indicators of compromise, affected endpoints, or specific configuration checks.

CVE-2026-119467: WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What access does an attacker need to exploit this issue?

Are default plugin configurations affected?

How can administrators determine whether they are exposed?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What access does an attacker need to exploit this issue?

Are default plugin configurations affected?

How can administrators determine whether they are exposed?