AnyWhere Elementor EUVD-2026-116087

Exploitation requires an authenticated session at a low privilege level (PR:L) on a WordPress site with AnyWhere Elementor installed at a version up to and including 1.3.0; the attack is remote over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). The available source does not describe the exact feature, endpoint, or configuration that triggers the sensitive-data exposure - the trigger mechanism is not described in the available sources. The limiting factor is the authentication requirement: an unauthenticated outsider cannot exploit this, so the practical exposure depends on how freely low-privilege accounts (e.g., subscribers/contributors) can be obtained or are provisioned on the target site. Impact is limited to confidentiality; no integrity or availability effect applies.

This is a moderate-risk, authenticated information-disclosure flaw (CWE-201) rather than a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity attack that nevertheless requires at least low-level authentication (PR:L) and yields only confidentiality impact (C:H) with no integrity or availability effect. The vuln.today decision label is 'this_month', which points to a scheduled-patching urgency, not emergency action. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference is present - the sole reference is the Patchstack advisory describing the issue. Taken together, the signals are internally consistent and point to a real but non-urgent issue: a widely-usable attack vector offset by an authentication requirement and confidentiality-only impact, with no evidence of active exploitation or public exploit code. Missing data to note explicitly: EPSS probability is absent, so widespread-exploitation likelihood cannot be quantified, and no fixed version is provided in the evidence (affected 'from n/a through 1.3.0').

An attacker who already holds a low-privileged account on a WordPress site running AnyWhere Elementor (through version 1.3.0) sends requests to the plugin, which embeds sensitive information into data it returns, allowing the attacker to retrieve that data. No public exploit code or PoC was identified at the time of analysis, and the low attack complexity (AC:L) means no special timing or conditions are needed once authenticated.