CVE-2026-2918

Summary

The Happy Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.21.0 via the ha_condition_update AJAX action. This is due to the validate_reqeust() method using current_user_can('edit_posts', $template_id) instead of current_user_can('edit_post', $template_id) — failing to perform object-level authorization. Additionally, the ha_get_current_condition AJAX action lacks a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify the display conditions of any published ha_library template. Because the cond_to_html() renderer outputs condition values into HTML attributes without proper escaping (using string concatenation instead of esc_attr()), an attacker can inject event handler attributes (e.g., onmouseover) that execute JavaScript when an administrator views the Template Conditions panel, resulting in Stored Cross-Site Scripting.

Affected Software

VendorProductVersion RangeStatus
thehappymonsterHappy Addons for Elementor0 <= 3.21.0affected

Weaknesses

  • CWE-639: CWE-639 Authorization Bypass Through User-Controlled Key

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References