CVE-2023-51676 MEDIUM

CVE-2023-51676: WordPress Happy Addons for Elementor Plugin <= 3.9.1.1 is vulnerable to Server Side Request Forgery (SSRF)

Vendor Leevio
Product Happy Addons for Elementor
Weakness CWE-918 · SSRF
Published December 29, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.9/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in Leevio Happy Addons for Elementor.This issue affects Happy Addons for Elementor: from n/a through 3.9.1.1.

Explanation of Vulnerability in Simple Terms

02Summary

Happy Addons for Elementor versions up to 3.9.1.1 contain a server-side request forgery vulnerability. An authenticated user with low privileges can make the site send HTTP requests to internal or external systems on the attacker's behalf. The impact is limited to low-level information disclosure and minor data modification. The vulnerability requires high attack complexity, suggesting it may need specific conditions or timing to exploit.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal systems or external URLs, potentially reading sensitive data or modifying resources.

Potential impact on your site

04Site Impact

Attackers with user accounts can probe your internal network, access private APIs, or trigger actions on external services from your site's IP address.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site; no user interaction required.

Key dates

06Disclosure timeline

December 29, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-25428 WordPress TS Poll plugin <= 2.5.5 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-0686 Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery CVE-2026-0688 Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery CVE-2026-32357 WordPress Simple Blog Card plugin <= 2.37 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-7049 PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter