HappyMonster Happy Addons CVE-2025-63077

This is a missing authorization vulnerability (CWE-862: Improper Access Control) affecting the Happy Addons for Elementor WordPress plugin, which is a page builder extension for Elementor. The root cause is the failure to properly validate user permissions before allowing access to protected functions or API endpoints. WordPress plugins typically authenticate users via nonce validation and capability checks (e.g., 'manage_options', 'edit_posts'), but this plugin apparently skips or misconfigures these checks on one or more sensitive operations. An authenticated user with basic credentials can therefore perform actions or view data reserved for higher-privilege roles (administrators or editors with specific capabilities). The vulnerability is classified as improper access control rather than authentication bypass, meaning the authentication layer itself is intact but authorization controls are deficient.