# HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.51.0 - Authenticated (Contributor+) Sensitive Information Exposure via Member Widget Lightbox Template

- **ID:** WPSEC-2026-2963
- **Plugin:** HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates (`happy-elementor-addons`), https://wordpress.org/plugins/happy-elementor-addons/
- **Affected versions:** from 3.0.0 before 3.51.3
- **Fixed in:** 3.51.3 (Update to 3.51.3 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/happy-elementor-addons
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2963/

## Description

The HappyAddons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the Team Member widget's lightbox template setting (saved_template_list) in versions 3.0.0 up to, and including, 3.51.0, due to the plugin passing the user-supplied post ID to Elementor's get_builder_content_for_display() without checking that it is a published Elementor template. This makes it possible for authenticated attackers, with contributor-level access and above, to render and view the Elementor content of arbitrary posts, including private and draft posts they should not have access to.

Also published later by wordfence as CVE-2026-124269.

## References

- https://wpsec.com/vuln/WPSEC-2026-2963/
- https://plugins.svn.wordpress.org/happy-elementor-addons/tags/3.51.3/
- https://wordpress.org/plugins/happy-elementor-addons/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2963/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.