WordPress Happy Addons for Elementor plugin <= 3.20.8 - Sensitive Data Exposure vulnerability

happy-elementor-addons · CWE-497 · CWE-497

Affectedhappy-elementor-addons

FixUpdate to 3.21.0 or newer

PublishedMay 7, 07:37 · Patchstack

ScoredMay 7 · 5.3 · Patchstack

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:05 UTC

What we know

No known exploitation. CISA KEV, checked 22:05 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

Description

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs Happy Addons for Elementor allows Retrieve Embedded Sensitive Data. This issue affects Happy Addons for Elementor: from n/a through 3.20.8.

From Patchstack

Affected and fixed versions

ProductAffectedFixed inhappy-elementor-addonsfrom n/a3.21.0

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

patchstack.com/database/wordpress/plugin/happy-elementor-addons/vulnerability/wordpress-happy-addons-for-elementor-plugin-3-20-8-sensitive-data-exposure-vulnerability?_s_id=cve · patchstack.comvdb entry

Other CVEs in happy-elementor-addons

All 4 →

6.4WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability · CVE-2026-109891Oct 29 6.5WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability · CVE-2026-116850Oct 29 6.5WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerability · CVE-2026-104393Oct 7