CVE-2026-2917 in Happy Addons for Elementor Plugin
Summary
by MITRE • 03/11/2026
The Happy Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.21.0 via the `ha_duplicate_thing` admin action handler. This is due to the `can_clone()` method only checking `current_user_can('edit_posts')` (a general capability) without performing object-level authorization such as `current_user_can('edit_post', $post_id)`, and the nonce being tied to the generic action name `ha_duplicate_thing` rather than to a specific post ID. This makes it possible for authenticated attackers, with Contributor-level access and above, to clone any published post, page, or custom post type by obtaining a valid clone nonce from their own posts and changing the `post_id` parameter to target other users' content. The clone operation copies the full post content, all post metadata (including potentially sensitive widget configurations and API tokens), and taxonomies into a new draft owned by the attacker.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/17/2026
The vulnerability described in CVE-2026-2917 affects the Happy Addons for Elementor WordPress plugin, specifically targeting versions up to and including 3.21.0. This represents a critical security flaw that enables unauthorized content duplication across user boundaries. The issue stems from an insecure direct object reference (IDOR) condition that undermines the plugin's authorization mechanisms. The vulnerability is particularly concerning because it allows authenticated attackers with contributor-level privileges or higher to manipulate the plugin's duplicate functionality in ways that were never intended by the developers.
The technical implementation of this vulnerability occurs within the `ha_duplicate_thing` admin action handler where the `can_clone()` method performs insufficient authorization checks. This method only verifies the general capability `current_user_can('edit_posts')` which grants broad permissions to users who can edit posts but fails to implement proper object-level authorization. The absence of specific post-level checks such as `current_user_can('edit_post', $post_id)` creates a dangerous gap in the plugin's security model. Additionally, the nonce validation mechanism uses a generic action name `ha_duplicate_thing` instead of binding the nonce to specific post identifiers, which eliminates the protection that nonces are designed to provide.
The operational impact of this vulnerability extends beyond simple content duplication and creates significant risks for WordPress sites using the affected plugin. Attackers can leverage this weakness to clone any published content regardless of the original author's permissions or ownership. This includes posts, pages, and custom post types that may contain sensitive information. The cloned content inherits all metadata, widget configurations, and potentially confidential API tokens or credentials that were embedded within the original posts. This makes the vulnerability particularly dangerous for sites that store sensitive data within their WordPress content management system.
From a cybersecurity perspective, this vulnerability maps directly to CWE-639: "Insecure Direct Object Reference" which is classified as a critical weakness in the Common Weakness Enumeration catalog. The flaw also aligns with ATT&CK technique T1213.002: "Data from Information Repositories" as it enables unauthorized access to content repositories through manipulation of object references. The vulnerability demonstrates a fundamental flaw in access control implementation where the system fails to properly validate that users have authorization to perform operations on specific objects they are attempting to access. The low privilege requirement for exploitation means that even users with relatively limited permissions can cause significant damage to site content integrity and potentially compromise sensitive data.
Organizations affected by this vulnerability should immediately implement mitigations including updating to the latest version of the Happy Addons plugin where the issue has been resolved. The fix typically involves implementing proper object-level authorization checks that verify users can edit specific posts rather than relying on general capabilities. Additionally, nonce validation should be strengthened to bind the nonce to specific post identifiers rather than generic action names. System administrators should also consider implementing monitoring for unusual duplicate operations and conduct thorough security audits of all installed plugins to identify similar authorization flaws that may exist in other components of the WordPress ecosystem.