AnyWhere Elementor EUVD-2026-116095

The advisory describes a missing authorization check ('Incorrectly Configured Access Control Security Levels') in AnyWhere Elementor versions up to and including 1.3.0, but the exact endpoint, action, or feature that lacks the capability check is not described in the available sources, so the precise trigger is unverified. Per the CVSS vector (PR:N/UI:N), exploitation is unauthenticated and needs no user interaction against an affected install reachable over the network. The practical limiting factor is impact scope rather than access: the flaw yields only limited confidentiality exposure (C:L, no integrity or availability impact), and it is bounded to sites running AnyWhere Elementor at or below version 1.3.0.

This is a moderate-severity Missing Authorization flaw (CWE-862) rated CVSS 5.3, and the available signals point to a low-to-moderate real-world priority rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity issue requiring no authentication, but the impact is deliberately narrow: C:L/I:N/A:N means only limited confidentiality exposure with no integrity or availability impact, consistent with an access-control gap that leaks or exposes restricted data rather than enabling takeover. No EPSS score, no CISA KEV listing, and no proof-of-concept were provided in the input, so there is no public evidence of active or imminent exploitation. The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with a scheduled-remediation posture rather than firefighting. Signals are internally consistent - there is no conflict between the network vector and the described broken-access-control mechanism - so the main limitation is simply the thinness of corroborating exploitation data: severity and exploitability are inferred from the single Patchstack advisory and the CVSS vector, not from any observed exploitation.

A remote, unauthenticated attacker sends a direct request to a plugin endpoint or action that fails to enforce an authorization/capability check, causing the plugin to return or act on data that should be restricted to privileged users. Because CVSS is AV:N/AC:L/PR:N/UI:N, this needs only network reach to the WordPress site and no login or user interaction, though the impact is limited to confidentiality (C:L). No public exploit code was identified in the provided data.