Insecure Direct Object Reference in Happy Addons for Elementor Plugin by WordPress

CVE-2026-2917

What is CVE-2026-2917?

The Happy Addons for Elementor plugin for WordPress features a vulnerability that allows authenticated users with Contributor-level access and above to exploit the ha_duplicate_thing admin action handler. This issue is rooted in insufficient object-level authorization checks in the can_clone() method, primarily relying on the generic capability of editing posts. As a result, attackers can clone published posts, pages, or custom post types by manipulating the post ID in a request using a valid nonce from their own posts. This unauthorized cloning operation potentially exposes full content, sensitive widget configurations, and API tokens, posing a significant risk to site integrity and security.

References