CVE-2026-25468
Exposure of Sensitive System Information in Happy Addons for Elementor
Publication date: 2026-05-07
Last updated on: 2026-05-07
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| we_devs | happy_addons_for_elementor | From 3.0.0 (inc) to 3.20.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-497 | The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-25468 is a vulnerability in the WordPress Happy Addons for Elementor Plugin, affecting versions 3.20.8 and earlier. It allows unauthenticated attackers to access sensitive system information that should normally be restricted. This exposure of sensitive data can potentially lead to further exploitation of system weaknesses.
The vulnerability is classified under the OWASP Top 10 category A3: Sensitive Data Exposure and does not require any privileges or user interaction to exploit.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized attackers to retrieve sensitive information from your system without any authentication. Such exposure can lead to increased risk of further attacks or exploitation of other vulnerabilities within your system.
Although the severity is considered low with a CVSS score of 5.3, the exposure of sensitive data can compromise the confidentiality of your system's information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability CVE-2026-25468 in Happy Addons for Elementor, you should immediately update the plugin to version 3.21.0 or later, as this patched version resolves the issue.
If you are using Patchstack, enabling auto-updates for vulnerable plugins is also recommended to reduce the risk of exploitation.