CVE-2024-1387

MEDIUM

Happy Addons for Elementor <= 3.10.4 - Unauthorized Data Access via duplicate_thing() Function

Title source: llm

Description

The Happy Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization on the duplicate_thing() function in all versions up to, and including, 3.10.4. This makes it possible for attackers, with contributor-level access and above, to clone arbitrary posts (including private and password protected ones) which may lead to information exposure.

References (3)

Core 3

Core References

Product

https://plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/classes/clone-handler.php#L58

Patch

https://plugins.trac.wordpress.org/changeset/3064385/happy-elementor-addons/trunk/classes/clone-handler.php?contextall=1&old=3044937&old_path=%2Fhappy-elementor-addons%2Ftrunk%2Fclasses%2Fclone-handler.php

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/aff10d5a-a2d0-461a-b52b-a25b647eaab4?source=cve

Scores

CVSS v3 4.3

EPSS 0.0060

EPSS Percentile 44.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

leevio/happy_addons_for_elementor < 3.10.4

thehappymonster/Happy Addons for Elementor < 3.10.4

Published Apr 09, 2024

Tracked Since Feb 18, 2026