CVE-2026-114189

Summary

A blind SQL injection flaw exists in the WPVibes AnyWhere Elementor plugin due to improper neutralization of user-supplied input in SQL queries. This allows an authenticated low-privilege attacker to infer database contents through time-based or boolean-based inference techniques.

Exploitability

Exploitation requires valid low-privilege authentication and network access to the vulnerable endpoint; no public exploit code is available, but blind SQLi techniques are well-known and reliably executable.

Blast radius

Successful exploitation could lead to full extraction of sensitive database contents including user credentials, post metadata, or site configuration, though data modification or direct code execution is not indicated by the description.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.3.1 or later of the AnyWhere Elementor plugin; if no fixed version is available, disable the plugin immediately and restrict access to authenticated users only pending vendor patch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.