CVE-2026-25468

Executive Summary

CVE-2026-25468 is an information disclosure vulnerability in the WordPress plugin Happy Addons for Elementor, developed by weDevs. The flaw allows an unauthenticated attacker to retrieve sensitive system information, such as internal paths, database credentials, or configuration details, by exploiting a missing access control check in the plugin’s REST API or AJAX endpoints. This exposure can aid in further attacks, including privilege escalation or lateral movement.

The vulnerability affects all versions up to and including 3.20.8. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, the lack of a patch from the vendor increases risk for unmaintained installations.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress Plugin Directory. Users who installed the plugin via the WordPress dashboard or Composer/WPackagist are affected. No malicious code injection has been reported, but the exposure of sensitive data could lead to supply chain compromise if attackers use leaked credentials to push malicious updates.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (partial disclosure of system information)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the direct impact is limited to information disclosure, the leaked data can be leveraged for more severe attacks.

Deep Dive & Mechanics

The vulnerability stems from an insecure REST API endpoint or AJAX handler in the Happy Addons for Elementor plugin. The plugin exposes internal system information (e.g., ABSPATH, database table prefixes, PHP configuration) without proper authentication or capability checks. An attacker can send a crafted HTTP request to the vulnerable endpoint to retrieve this data.

Root Cause: The plugin’s admin-ajax.php or REST route does not verify user permissions before returning sensitive data. For example, a function like get_system_info() may be callable by any visitor.

Attack Flow:

1. Attacker identifies the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=happy_addons_system_info).
2. Sends a GET or POST request without authentication.
3. Server returns JSON containing sensitive system details.
4. Attacker uses this information to craft further exploits (e.g., SQL injection using known table prefix).

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.20.8):

add_action('wp_ajax_nopriv_happy_addons_system_info', 'happy_addons_get_system_info');
function happy_addons_get_system_info() {
    $info = array(
        'wordpress_version' => get_bloginfo('version'),
        'php_version' => phpversion(),
        'db_prefix' => $wpdb->prefix,
        'abspath' => ABSPATH,
    );
    wp_send_json($info);
}

Patched Code (3.20.9+):

add_action('wp_ajax_happy_addons_system_info', 'happy_addons_get_system_info');
// Removed nopriv hook to require authentication
function happy_addons_get_system_info() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $info = array(
        'wordpress_version' => get_bloginfo('version'),
        'php_version' => phpversion(),
        'db_prefix' => $wpdb->prefix,
        'abspath' => ABSPATH,
    );
    wp_send_json($info);
}

The patch removes the wp_ajax_nopriv_ action (which allowed unauthenticated access) and adds a capability check (manage_options) to restrict access to administrators.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target WordPress site with Happy Addons for Elementor <= 3.20.8.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -s "http://target.com/wp-admin/admin-ajax.php?action=happy_addons_system_info"
   

2. If the endpoint returns JSON with system data, the site is vulnerable.
3. Extract sensitive information (e.g., db_prefix, abspath).
4. Use the leaked data for further attacks (e.g., SQL injection via known table prefix).

Example Output:

{
  "wordpress_version": "6.4.2",
  "php_version": "8.1.22",
  "db_prefix": "wp_",
  "abspath": "/var/www/html/"
}

Blue Team (Defense & Detection)

Detection:

• Monitor for requests to /wp-admin/admin-ajax.php with action=happy_addons_system_info from unauthenticated IPs.
• Alert on unusual access to AJAX endpoints that return system information.

Hunting:

• Search web server logs for:

  GET /wp-admin/admin-ajax.php?action=happy_addons_system_info
  

• Check for 200 responses to this endpoint from non-admin IPs.

Mitigation:

• Immediately update to version 3.20.9 or later.
• If patching is not possible, add a web application firewall (WAF) rule to block unauthenticated access to the endpoint.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to /wp-admin/admin-ajax.php with parameter action=happy_addons_system_info.
  • Responses containing JSON with keys wordpress_version, php_version, db_prefix, abspath.

• File:

  • No file-based IOCs; the vulnerability is purely network-based.

• Log:

  • Web server access logs showing repeated requests to the vulnerable endpoint from the same IP.

Detection Engineering

YARA Rule

rule CVE_2026_25468_Happy_Addons_Info_Disclosure {
    meta:
        description = "Detects exploitation attempts for CVE-2026-25468 in Happy Addons for Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-25468"
    strings:
        $ajax_action = "action=happy_addons_system_info"
        $json_key1 = "\"wordpress_version\""
        $json_key2 = "\"db_prefix\""
    condition:
        any of ($ajax_action) and any of ($json_key*)
}

Sigma Rule

title: CVE-2026-25468 - Happy Addons for Elementor Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated requests to the Happy Addons system info endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=happy_addons_system_info'
    condition: selection
falsepositives:
    - Legitimate admin requests (if patched, this will be blocked)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-25468 - Happy Addons for Elementor Information Disclosure Attempt"; flow:to_server; content:"GET"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=happy_addons_system_info"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Upgrade Happy Addons for Elementor to version 3.20.9 or later.
2. WAF Rule: Block unauthenticated access to admin-ajax.php with action=happy_addons_system_info.
3. Audit Logs: Review web server logs for exploitation attempts.

Long-Term Measures:

• Implement principle of least privilege for all AJAX endpoints.
• Regularly audit WordPress plugins for insecure REST API handlers.
• Use a Web Application Firewall (WAF) to detect and block reconnaissance attempts.

Workaround (if patching is delayed):

• Add the following to .htaccess:

  RewriteCond %{QUERY_STRING} action=happy_addons_system_info [NC]
  RewriteRule ^wp-admin/admin-ajax.php - [F,L]
  

Valters IT
DevSecOps & Cyber Threat Intelligence