### [CVE-2023-0443](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0443)
![](https://img.shields.io/static/v1?label=Product&message=AnyWhere%20Elementor&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.2.5%3C%201.2.8%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brighgreen)

### Description

The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked.

### POC

#### Reference
- https://wpscan.com/vulnerability/471f3226-8f90-43d1-b826-f11ef4bbd602

#### Github
No PoCs found on GitHub currently.