CVE-2026-109891: WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability

Q: What access does an attacker need to exploit this issue?

The attacker needs low-level privileges. Exploitation does not require user interaction and is rated as low complexity over the network.

Q: What is the expected security impact?

The reported impact is low confidentiality and low integrity impact, with no availability impact. The issue is rated with changed scope.

Q: How can I determine whether an installation is in the reported affected range?

Check the installed Happy Addons for Elementor version. The issue is reported to affect versions through 3.50.1; no lower affected version is specified in the provided data.

Published Oct 29, 2026

Updated

Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Happy Addons for Elementor to a version that resolves this vulnerability.
Fixed in 3.51.0

Event History

Oct 29, 2026

CVE Published

via MITRE·03:04 PM

Data Sourced

via MITRE·03:04 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs low-level privileges. Exploitation does not require user interaction and is rated as low complexity over the network.

What is the expected security impact?

The reported impact is low confidentiality and low integrity impact, with no availability impact. The issue is rated with changed scope.

How can I determine whether an installation is in the reported affected range?