CVE-2024-1387
Happy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information Exposure
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
The Happy Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization on the duplicate_thing() function in all versions up to, and including, 3.10.4. This makes it possible for attackers, with contributor-level access and above, to clone arbitrary posts (including private and password protected ones) which may lead to information exposure.
| CWE | CWE-862 |
| Vendor | thehappymonster |
| Product | happy addons for elementor |
| Published | Apr 9, 2024 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for thehappymonster happy addons for elementor
Be the first to know when new medium vulnerabilities affecting thehappymonster happy addons for elementor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
thehappymonster / Happy Addons for Elementor
0 ≤ 3.10.4
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/aff10d5a-a2d0-461a-b52b-a25b647eaab4?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/classes/clone-handler.php#L58 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3064385/happy-elementor-addons/trunk/classes/clone-handler.php?contextall=1&old=3044937&old_path=%2Fhappy-elementor-addons%2Ftrunk%2Fclasses%2Fclone-handler.php
Credits
Lucio Sá