CVE-2025-31046

WordPress AnyWhere Elementor Pro plugin <= 2.29 - Broken Access Control Vulnerability

View on CVE.org
Published Jan 5, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor Pro: from n/a through 2.29.

Analysis

AI-generated

Technical impact

The vulnerability in WPvibes AnyWhere Elementor Pro allows an attacker to gain unauthorized access because the plugin fails to enforce proper authorisation checks. This missing authorisation can lead to an attacker performing actions or reading content that should be restricted. The weakness is classified as CWE‑862.

Affected Systems

WordPress sites that use the WPvibes AnyWhere Elementor Pro plugin, versions up to 2.29, are affected. The plugin is implicated when access control settings are incorrectly configured.

Risk and Exploitability

The CVSS score is 4.3, indicating medium risk. The EPSS score of less than 1 % reflects low probability of exploitation, and the vulnerability is not included in CISA’s KEV catalog. Based on the description, the likely attack vector is through the web interface of a WordPress site that has the plugin installed, where a user could exploit the improperly configured access controls. The impact is confined to the scope of the WordPress user who has the plugin and its configuration.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the AnyWhere Elementor Pro plugin to version 2.30 or later, which contains the authorisation fix.
  • Remove or disable the plugin if an upgrade cannot be performed immediately.
  • Verify that any leftover configuration sets proper access control levels and restricts access only to authorized users.

Generated by OpenCVE AI on May 1, 2026 at 05:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro anywhere-elementor-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor Pro: from n/a through <= 2.29. Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor Pro: from n/a through 2.29.
References
Type Values Removed Values Added
Description Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor Pro: from n/a through 2.29. Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro anywhere-elementor-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor Pro: from n/a through <= 2.29.
References
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpvibes
Wpvibes anywhere Elementor
Vendors & Products Wordpress
Wordpress wordpress
Wpvibes
Wpvibes anywhere Elementor
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor Pro: from n/a through 2.29.
Title WordPress AnyWhere Elementor Pro plugin <= 2.29 - Broken Access Control Vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}
Earlier changes (4)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:12 PM
Reserved
Mar 26, 2025, 9:23 AM

View source JSON

Updated
Jan 5, 2026, 7:48 PM

JSON

Status
Deferred
Published
Jan 5, 2026, 11:17 AM
Modified
Oct 7, 2026, 10:10 AM

View source JSON

No data.

Updated
May 1, 2026, 6:00 AM

JSON