What’s Vulnerable › Vulnerabilities

CVE-2023-0443: AnyWhere Elementor < 1.2.8 - Freemius API Key Disclosure

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-05-30 · updated 2026-06-17

Description

The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked.

Affected products

• AnyWhere Elementor: before 1.2.8 — fixed in 1.2.8

How to fix

Upgrade to a fixed version: AnyWhere Elementor 1.2.8. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/471f3226-8f90-43d1-b826-f11ef4bbd602
• https://wpscan.com/vulnerability/471f3226-8f90-43d1-b826-f11ef4bbd602

Get alerted when CVE-2023-0443 or the next vulnerability affects your stack