{"id":"CVE-2026-124269","kind":"vulnerability","aliases":["CVE-2026-124269"],"related":[],"title":"Happy Addons for Elementor: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.51.0.","summary":"Happy Addons for Elementor, a WordPress plugin by weDevs, has a missing authorization check that allows exploiting incorrectly configured access control levels. The sources do not say what data or actions an attacker gains beyond that.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","happy-addons","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Happy Addons for Elementor version in the WordPress admin plugins list, or with `wp plugin get happy-elementor-addons --field=version`","fix":"- Happy Addons for Elementor: versions through `3.51.0` are affected; move to a later release (the fixed version is not stated in the sources)","status":"open","published_at":"2026-11-11T13:17:18+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","triaged_at":"2026-11-11T13:29:50+00:00","updated_at":"2026-11-11T13:29:50+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T13:29:50Z","model":"claude-haiku-5-5","output":{"fix":"- Happy Addons for Elementor: versions through `3.51.0` are affected; move to a later release (the fixed version is not stated in the sources)","reach":"internet","title":"Happy Addons for Elementor: missing authorization check exposes access controls","impact":"medium","summary":"Happy Addons for Elementor, a WordPress plugin by weDevs, has a missing authorization check that allows exploiting incorrectly configured access control levels. The sources do not say what data or actions an attacker gains beyond that.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","happy-addons"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Confirm the fixed version and the exact access-control impact from the NVD entry or the weDevs changelog.","how_to_check":"- Check the installed Happy Addons for Elementor version in the WordPress admin plugins list, or with `wp plugin get happy-elementor-addons --field=version`\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Happy Addons for Elementor WordPress plugin at version 3.51.0 or earlier are in the affected range. The sources do not say which roles or configurations are needed to exploit it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000716,"input_tokens":4553,"output_tokens":521,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124269':13A,16A '-2026':12A,15A '3.51.0':88C 'access':9A,42B,75C 'action':53B 'addon':2A,20B,24B,64C,70C,82C 'affect':80C 'allow':38B,71C 'attack':55B 'author':6A,35B,59C 'beyond':57B 'check':7A,36B 'configur':41B,74C 'control':10A,43B,76C 'cve':11A,14A 'data':51B 'elementor':4A,17B,26B,66C,69C,84C 'exploit':39B,72C 'expos':8A 'gain':56B 'happi':1A,19B,23B,63C,68C,81C 'happy-addon':18B 'happy-elementor-addon':67C 'incorrect':40B,73C 'issu':79C 'level':44B 'levels.this':78C 'miss':5A,34B,58C 'n/a':86C 'packag':21B 'plugin':29B 'say':49B 'secur':77C 'sourc':46B 'vulner':60C 'wedev':31B,62C 'wordpress':22B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Happy Addons for Elementor WordPress plugin at version 3.51.0 or earlier are in the affected range. The sources do not say which roles or configurations are needed to exploit it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","happyaddons","medium","package","wordpress"],"campaign_type":null,"search_a":"'-124269':13A,16A '-2026':12A,15A 'access':9A 'addon':2A 'author':6A 'check':7A 'control':10A 'cve':11A,14A 'elementor':4A 'expos':8A 'happi':1A 'miss':5A","search_b":"'access':42B 'action':53B 'addon':20B,24B 'allow':38B 'attack':55B 'author':35B 'beyond':57B 'check':36B 'configur':41B 'control':43B 'data':51B 'elementor':17B,26B 'exploit':39B 'gain':56B 'happi':19B,23B 'happy-addon':18B 'incorrect':40B 'level':44B 'miss':34B 'packag':21B 'plugin':29B 'say':49B 'sourc':46B 'wedev':31B 'wordpress':22B,28B","search_c":"'3.51.0':88C 'access':75C 'addon':64C,70C,82C 'affect':80C 'allow':71C 'author':59C 'configur':74C 'control':76C 'elementor':66C,69C,84C 'exploit':72C 'happi':63C,68C,81C 'happy-elementor-addon':67C 'incorrect':73C 'issu':79C 'levels.this':78C 'miss':58C 'n/a':86C 'secur':77C 'vulner':60C 'wedev':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124269","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124269","severity":null,"published_at":"2026-11-11T13:17:18+00:00","modified_at":"2026-11-11T13:17:18+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","fetched_at":"2026-11-11T13:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}