# CVE-2026-102564: Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer

Status: published. Published: 2026-11-07. Updated: 2026-11-07.

The The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a public post rendered through an AE template that includes the AE Post Comments widget, and for the attacker's comment to be visible on that page — a barrier removed once the attacker has a previously approved comment or when comment moderation is relaxed.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- wpvibes / Dynific Addons for Elementor (formerly Anywhere Elementor): ≥ 0; ≤ 1.3.0 (affected, semver). Source: CNA: Wordfence

## Severity and prioritization

- CVSS 3.1: 6.5 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N; source: CNA: Wordfence

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-94

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/15ee70d7-1e55-46a3-9b4c-5b04fa7fea04?source=cve (CNA: Wordfence)

- https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/frontend.php#L205 (CNA: Wordfence)

- https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/shortcode.php#L27 (CNA: Wordfence)

- https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/modules/post-comments/widgets/ae-post-comments.php#L191 (CNA: Wordfence)

- https://plugins.trac.wordpress.org/browser/anywhere-elementor/tags/1.3.1/includes/modules/post-comments/widgets/ae-post-comments.php (CNA: Wordfence)

## Provenance

- CNA: Wordfence: https://www.cve.org/CVERecord?id=CVE-2026-102564; retrieved 2026-11-07; source updated 2026-11-07

Revision: d46d006cb0f70d0f976a4dbb147e676cd6d51b5bc5d074374551f2e66d4f25c9

Canonical: https://y2.dev/cve/CVE-2026-102564

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.