Technical impact
The vulnerability in Happy Addons for Elementor allows an unauthorized party to retrieve embedded sensitive system information. This results in compromise of confidentiality, giving attackers access to data that should be protected but does not affect integrity or availability directly. The weakness is identified as CWE‑497, a data exposure flaw.
Affected Systems
The affected product is weDevs' Happy Addons for Elementor plugin, versions from unspecified initial releases through 3.20.8. Any installation using a version equal to or less than 3.20.8 is vulnerable.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity. EPSS data are not available, so the likelihood of exploitation cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the plugin’s web‑based nature, the most likely attack path involves a remote attacker interacting with the WordPress site to trigger the data exposure, although specific authentication or privilege prerequisites have not been disclosed in the description.
