WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability

happy-elementor-addons · Missing authorization · CWE-862

Affectedhappy-elementor-addons

FixUpdate to 3.51.0 or newer

PublishedOct 29, 15:04 · Patchstack

ScoredOct 29 · 6.4 · Patchstack

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:04 UTC

What we know

No known exploitation. CISA KEV, checked 22:04 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker needs network access and an account. CVSS: network, low privileges.

Description

Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.

From Patchstack

Affected and fixed versions

ProductAffectedFixed inhappy-elementor-addonsearlier versions3.51.0

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

patchstack.com/database/wordpress/plugin/happy-elementor-addons/vulnerability/wordpress-happy-addons-for-elementor-plugin-3-50-1-broken-access-control-vulnerability?_s_id=cve · patchstack.comvdb entry

Other CVEs in happy-elementor-addons

All 4 →

6.5WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability · CVE-2026-116850Oct 29 6.5WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerability · CVE-2026-104393Oct 7 5.3WordPress Happy Addons for Elementor plugin <= 3.20.8 - Sensitive Data Exposure vulnerability · CVE-2026-25468May 7