# CVE-2026-109891: weDevs Happy Addons for Elementor broken access control

Source: https://junglewise.ai/threats/cve-2026-109891-missing-authorization-vulnerability-in-wedevs-happy-addons-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-109891 · Severity: medium · CVSS 6.4 · Published 2026-10-29

Happy Addons for Elementor is a WordPress plugin that extends the Elementor page builder with additional design elements and functionality. A broken access control vulnerability allows authenticated users with contributor-level permissions to access or perform actions they should not be authorized to perform, such as viewing or modifying data belonging to other users.

Technologies: [weDevs Happy Addons for Elementor](https://junglewise.ai/threats/technologies/wedevs-happy-addons-for-elementor). Vendors: [weDevs](https://junglewise.ai/threats/vendors/wedevs).

## Quick answers

**Is CVE-2026-109891 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109891 being exploited in the wild.

**How severe is CVE-2026-109891?** Medium severity, with a CVSS score of 6.4, published 29 October 2026.

**Which products and versions are affected?** weDevs Happy Addons for Elementor up to 3.50.1.

**Is there a fix for CVE-2026-109891?** Yes: fixed in 3.51.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109891 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109891?** Check whether you run weDevs Happy Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.51.0

## Technical details

The vulnerability is a broken access control flaw (CWE-284) affecting Happy Addons for Elementor versions up to 3.50.1. An attacker with contributor-level WordPress privileges can exploit incorrectly configured access controls to perform unauthorized actions or access restricted data. The issue was patched in version 3.51.0.

## Affected products

- weDevs Happy Addons for Elementor up to 3.50.1

## Timeline

- 2026-10-29: disclosed
- 2026-10-29: patched

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/happy-elementor-addons/vulnerability/wordpress-happy-addons-for-elementor-plugin-3-50-1-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/happy-elementor-addons/vulnerability/wordpress-happy-addons-for-elementor-plugin-3-50-1-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [weDevs Happy Addons for Elementor broken access control](https://junglewise.ai/threats/cve-2026-124269-missing-authorization-vulnerability-in-wedevs-happy-addons-for)
- [weDevs Happy Addons for Elementor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-123473-improper-neutralization-of-input-during-web-page-generation)
- [weDevs Happy Addons for Elementor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116850-improper-neutralization-of-input-during-web-page-generation)
- [Happy Addons for Elementor cross-site scripting in contributor actions](https://junglewise.ai/threats/cve-2026-62080-contributor-cross-site-scripting-xss-in-happy-addons-for)