{"id":"CVE-2026-114189","published":"2026-11-08T16:16:37.247","lastModified":"2026-11-08T19:17:34.230","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/anywhere-elementor/vulnerability/wordpress-anywhere-elementor-plugin-1-3-0-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A blind SQL injection flaw exists in the WPVibes AnyWhere Elementor plugin due to improper neutralization of user-supplied input in SQL queries. This allows an authenticated low-privilege attacker to infer database contents through time-based or boolean-based inference techniques.","exploitability":"Exploitation requires valid low-privilege authentication and network access to the vulnerable endpoint; no public exploit code is available, but blind SQLi techniques are well-known and reliably executable.","blast_radius":"Successful exploitation could lead to full extraction of sensitive database contents including user credentials, post metadata, or site configuration, though data modification or direct code execution is not indicated by the description.","remediation":"Upgrade to version 1.3.1 or later of the AnyWhere Elementor plugin; if no fixed version is available, disable the plugin immediately and restrict access to authenticated users only pending vendor patch.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","blind-sqli","web","auth-bypass","plugin","wordpress"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:52:58.847Z"}}