Description
The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status or capability check when resolving post identifiers passed to one of its shortcodes, allowing authenticated users with at least the Contributor role to disclose the content of other users' draft, private and password-protected posts. An Author can republish that content to anonymous visitors.
Published: 2026-11-11
Score: 2.7 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Nov 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}

Wed, 11 Nov 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status or capability check when resolving post identifiers passed to one of its shortcodes, allowing authenticated users with at least the Contributor role to disclose the content of other users' draft, private and password-protected posts. An Author can republish that content to anonymous visitors.
Title Dynific Addons for Elementor 1.3 - Contributor+ Arbitrary Post Content Disclosure via dynific_template Shortcode
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-11-11T11:41:20.438Z

Reserved: 2026-10-27T09:35:15.868Z

Link: CVE-2026-117524

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-11T06:17:14.647

Modified: 2026-11-11T12:18:58.293

Link: CVE-2026-117524

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor