CVE-2026-2917 PUBLISHED

Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter

Assigner: Wordfence
Reserved: 20.02.2026 Published: 11.03.2026 Updated: 11.03.2026

The Happy Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.21.0 via the ha_duplicate_thing admin action handler. This is due to the can_clone() method only checking current_user_can('edit_posts') (a general capability) without performing object-level authorization such as current_user_can('edit_post', $post_id), and the nonce being tied to the generic action name ha_duplicate_thing rather than to a specific post ID. This makes it possible for authenticated attackers, with Contributor-level access and above, to clone any published post, page, or custom post type by obtaining a valid clone nonce from their own posts and changing the post_id parameter to target other users' content. The clone operation copies the full post content, all post metadata (including potentially sensitive widget configurations and API tokens), and taxonomies into a new draft owned by the attacker.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 5.4

Product Status

Vendor thehappymonster
Product Happy Addons for Elementor
Versions Default: unaffected
  • affected from * to 3.21.0 (incl.)

Credits

  • Dmitrii Ignatyev finder

References

Problem Types

  • CWE-639 Authorization Bypass Through User-Controlled Key CWE