{
 "id": "WPSEC-2026-1807",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1807/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1807/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1807/index.md",
 "title": "HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.1 - Authenticated (Contributor+) Sensitive Information Exposure via Mailchimp Widget",
 "description": "The HappyAddons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the Mailchimp widget in all versions up to, and including, 3.50.1, due to the site's global Mailchimp API key being embedded in the widget's editor control parameters and sent to the browser. This makes it possible for authenticated attackers, with contributor-level access and above who can use the Elementor editor, to retrieve the site's Mailchimp API key and use it to access or modify the connected Mailchimp account.",
 "plugin": {
  "slug": "happy-elementor-addons",
  "name": "HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates",
  "full_name": "HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates",
  "wordpress_org": "https://wordpress.org/plugins/happy-elementor-addons/",
  "advisories_url": "https://wpsec.com/vuln/plugin/happy-elementor-addons/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/happy-elementor-addons"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.51.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.51.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.51.0",
 "remediation": "Update to 3.51.0 or later.",
 "fix_released": "2026-10-27T05:51:42+00:00",
 "published": "2026-10-28T06:42:37+00:00",
 "updated": "2026-10-27T13:40:36.228417+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1807/",
  "https://plugins.svn.wordpress.org/happy-elementor-addons/tags/3.51.0/",
  "https://wordpress.org/plugins/happy-elementor-addons/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/happy-elementor-addons",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-28"
 }
}