What is GHSA-mr7p-7m35-rxjq?

GHSA-mr7p-7m35-rxjq is a security advisory published by GitHub Security Advisories with Medium severity. The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does...

Which CVE IDs does GHSA-mr7p-7m35-rxjq cover?

GHSA-mr7p-7m35-rxjq covers the following CVE IDs: CVE-2026-117523. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mr7p-7m35-rxjq?

GHSA-mr7p-7m35-rxjq has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-mr7p-7m35-rxjqMediumCVSS 4.3

The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does...

Vendor

GitHub Security Advisories

Published

November 11, 2026

Last Modified

November 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-117523 →

📋 Description

The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1's modules site-wide.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-117523
https://wpscan.com/vulnerability/689cf390-e7fa-4202-b418-9ec0066f778a
https://github.com/advisories/GHSA-mr7p-7m35-rxjq