SQL injection in Dynific Addons for Elementor exposes database data
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress by wpvibes is affected up to and including version 1.3. Insufficient escaping of the 'q' parameter in the ae_preview_post() AJAX handler allows SQL injection (CWE-89). An authenticated attacker with Subscriber-level access or higher can append SQL queries to existing queries and extract sensitive information from the database.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
The Dynific Addons for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'q' parameter in versions up to, and including, 1.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the ae_preview_post() AJAX handler and its preview_post_filter() posts_where callback, where the value is passed through $wpdb->esc_like() (addcslashes for '_%\\') and concatenated into a single-quoted SQL LIKE literal — a construction that does not escape single quotes and actively escapes the backslash wp_magic_quotes places before the attacker's quote, freeing it to terminate the literal. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Dynific Addons for Elementor.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Timeline
- 2026-11-07 Threatist record created from CVE-2026-103914
- 2026-11-07 Alias added: GHSA-5478-984c-7xfc
- 2026-11-08 CISA SSVC decision points changed
- 2026-11-08 Priority changed: MEDIUM → LOW
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1691f4-5659-41c0-9035-93556a78f07b?source=cve
- https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/admin/admin-helper.php#L91
- https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/admin/admin-helper.php#L119
- https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/admin/admin-helper.php#L99
- https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/aepro.php#L460
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3779229%40anywhere-elementor&new=3779229%40anywhere-elementor
More wpvibes vulnerabilities
- TI-2024-01266 Elementor Addon Elements <= 1.12.12 - Directory Traversal to Local File Inclusion CVSS 3.1HIGH 8.8
- TI-2023-05195 WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints CVSS 3.1HIGH 7.6
- TI-2022-03455 Form Vibes < 1.4.5 - Admin+ SQLi CVSS 3.1HIGH 7.2
- TI-2023-00420 AnyWhere Elementor < 1.2.8 - Freemius API Key Disclosure CVSS 3.1MEDIUM 5.3
- TI-2024-01328 Elementor Addon Elements <= 1.12.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet CVSS 3.1MEDIUM 6.4
- TI-2023-05215 WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpoint CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-103914 · CVE Program
- CVE-2026-103914 · NVD
- GHSA-5478-984c-7xfc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences