# CVE-2026-103914: Dynific Addons for Elementor SQL injection in preview handler

Source: https://junglewise.ai/threats/cve-2026-103914-the-dynific-addons-for-elementor-plugin-for-wordpress-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-103914 · Severity: medium · CVSS 6.5 · Published 2026-11-07

Dynific Addons for Elementor is a WordPress plugin that extends the Elementor page builder. A flaw in the preview feature allows authenticated users with basic subscriber permissions to inject malicious SQL commands and extract sensitive data from the site's database, such as user information or confidential content.

Technologies: [Dynific Addons for Elementor](https://junglewise.ai/threats/technologies/dynific-addons-for-elementor). Vendors: [Dynific](https://junglewise.ai/threats/vendors/dynific).

## Quick answers

**Is CVE-2026-103914 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103914 being exploited in the wild.

**How severe is CVE-2026-103914?** Medium severity, with a CVSS score of 6.5, published 7 November 2026.

**Which products and versions are affected?** Dynific Addons for Elementor up to and including 1.3.

**Is there a fix for CVE-2026-103914?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103914 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-103914?** Check whether you run Dynific Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ae_preview_post() AJAX handler and preview_post_filter() callback improperly escape the 'q' parameter using $wpdb->esc_like() and concatenate it into a single-quoted SQL LIKE literal, which does not prevent SQL injection. An attacker with Subscriber-level access can inject SQL by supplying a quote character to break out of the string context and append arbitrary SQL, bypassing the insufficient escaping mechanism.

## Affected products

- Dynific Addons for Elementor up to and including 1.3

## Timeline

- 2026-11-07: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/admin/admin-helper.php](https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/admin/admin-helper.php)
- [https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/admin/admin-helper.php](https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/admin/admin-helper.php)

## Related threats

- [Dynific Addons for Elementor information disclosure via shortcode](https://junglewise.ai/threats/cve-2026-117524-the-dynific-addons-for-elementor-formerly-anywhere-elementor)
- [Dynific Addons for Elementor privilege escalation in AJAX module settings](https://junglewise.ai/threats/cve-2026-117523-the-dynific-addons-for-elementor-formerly-anywhere-elementor)
- [Dynific Addons for Elementor stored XSS in post title via widget](https://junglewise.ai/threats/cve-2026-117522-the-dynific-addons-for-elementor-formerly-anywhere-elementor)
- [Dynific Addons for Elementor unescaped profile value in Post Author widget](https://junglewise.ai/threats/cve-2026-117521-the-dynific-addons-for-elementor-formerly-anywhere-elementor)
- [Dynific Addons for Elementor arbitrary shortcode execution](https://junglewise.ai/threats/cve-2026-102564-the-the-dynific-addons-for-elementor-formerly-anywhere-elementor)