SQL Injection in HappyAddons for Elementor Happy Clone

The Happy Clone feature of HappyAddons for Elementor copied a post’s custom fields into the clone with a hand-built SQL query that did not escape the custom field name. A user with Contributor access or higher could add a crafted custom field to their own post and clone it to run arbitrary SQL, for example to read password hashes from the database. Affects versions 2.4.0 through 3.20.4; fixed in 3.20.6 and finalised in 3.20.7.

This vulnerability affects the following application versions:

  • HappyAddons for Elementor 2.4.0
  • HappyAddons for Elementor 2.4.1
  • HappyAddons for Elementor 2.4.2
  • HappyAddons for Elementor 2.5.0
  • HappyAddons for Elementor 2.6.0
  • HappyAddons for Elementor 2.6.1
  • HappyAddons for Elementor 2.7.0
  • HappyAddons for Elementor 2.7.1
  • HappyAddons for Elementor 2.7.2
  • HappyAddons for Elementor 2.7.3
  • HappyAddons for Elementor 2.8.0
  • HappyAddons for Elementor 2.8.1
  • HappyAddons for Elementor 2.9.0
  • HappyAddons for Elementor 2.10.0
  • HappyAddons for Elementor 2.11.0
  • HappyAddons for Elementor 2.11.1
  • HappyAddons for Elementor 2.12.0
  • HappyAddons for Elementor 2.12.1
  • HappyAddons for Elementor 2.12.2
  • HappyAddons for Elementor 2.12.3
  • HappyAddons for Elementor 2.13.0
  • HappyAddons for Elementor 2.13.1
  • HappyAddons for Elementor 2.13.2
  • HappyAddons for Elementor 2.13.3
  • HappyAddons for Elementor 2.14.0
  • HappyAddons for Elementor 2.14.1
  • HappyAddons for Elementor 2.14.2
  • HappyAddons for Elementor 2.14.3
  • HappyAddons for Elementor 2.15.0
  • HappyAddons for Elementor 2.16.0
  • HappyAddons for Elementor 2.16.1
  • HappyAddons for Elementor 2.17.0
  • HappyAddons for Elementor 2.17.1
  • HappyAddons for Elementor 2.18.0
  • HappyAddons for Elementor 2.19.0
  • HappyAddons for Elementor 2.20.0
  • HappyAddons for Elementor 2.21.0
  • HappyAddons for Elementor 2.21.1
  • HappyAddons for Elementor 2.22.0
  • HappyAddons for Elementor 2.22.1
  • HappyAddons for Elementor 2.23.0
  • HappyAddons for Elementor 2.24.0
  • HappyAddons for Elementor 2.24.1
  • HappyAddons for Elementor 2.25.0
  • HappyAddons for Elementor 2.26.0
  • HappyAddons for Elementor 2.27.0
  • HappyAddons for Elementor 3.0.0
  • HappyAddons for Elementor 3.0.1
  • HappyAddons for Elementor 3.1.0
  • HappyAddons for Elementor 3.2.1
  • HappyAddons for Elementor 3.2.2
  • HappyAddons for Elementor 3.3.0
  • HappyAddons for Elementor 3.3.1
  • HappyAddons for Elementor 3.3.2
  • HappyAddons for Elementor 3.3.3
  • HappyAddons for Elementor 3.4.0
  • HappyAddons for Elementor 3.4.1
  • HappyAddons for Elementor 3.4.2
  • HappyAddons for Elementor 3.4.3
  • HappyAddons for Elementor 3.4.4
  • HappyAddons for Elementor 3.5.0
  • HappyAddons for Elementor 3.5.1
  • HappyAddons for Elementor 3.5.2
  • HappyAddons for Elementor 3.6.0
  • HappyAddons for Elementor 3.6.1
  • HappyAddons for Elementor 3.6.2
  • HappyAddons for Elementor 3.6.3
  • HappyAddons for Elementor 3.7.0
  • HappyAddons for Elementor 3.7.1
  • HappyAddons for Elementor 3.7.2
  • HappyAddons for Elementor 3.8.0
  • HappyAddons for Elementor 3.8.1
  • HappyAddons for Elementor 3.8.2
  • HappyAddons for Elementor 3.8.3
  • HappyAddons for Elementor 3.8.4
  • HappyAddons for Elementor 3.8.5
  • HappyAddons for Elementor 3.8.6
  • HappyAddons for Elementor 3.8.7
  • HappyAddons for Elementor 3.8.8
  • HappyAddons for Elementor 3.8.9
  • HappyAddons for Elementor 3.9.0
  • HappyAddons for Elementor 3.9.1
  • HappyAddons for Elementor 3.9.1.1
  • HappyAddons for Elementor 3.10.0
  • HappyAddons for Elementor 3.10.1
  • HappyAddons for Elementor 3.10.2
  • HappyAddons for Elementor 3.10.3
  • HappyAddons for Elementor 3.10.4
  • HappyAddons for Elementor 3.10.5
  • HappyAddons for Elementor 3.10.6
  • HappyAddons for Elementor 3.10.7
  • HappyAddons for Elementor 3.10.8
  • HappyAddons for Elementor 3.10.9
  • HappyAddons for Elementor 3.11.0
  • HappyAddons for Elementor 3.11.1
  • HappyAddons for Elementor 3.11.2
  • HappyAddons for Elementor 3.11.3
  • HappyAddons for Elementor 3.12.0
  • HappyAddons for Elementor 3.12.1
  • HappyAddons for Elementor 3.12.2
  • HappyAddons for Elementor 3.12.3
  • HappyAddons for Elementor 3.12.4
  • HappyAddons for Elementor 3.12.5
  • HappyAddons for Elementor 3.12.6
  • HappyAddons for Elementor 3.13.0
  • HappyAddons for Elementor 3.14.0
  • HappyAddons for Elementor 3.14.1
  • HappyAddons for Elementor 3.15.0
  • HappyAddons for Elementor 3.15.1
  • HappyAddons for Elementor 3.15.2
  • HappyAddons for Elementor 3.16.0
  • HappyAddons for Elementor 3.16.1
  • HappyAddons for Elementor 3.16.2
  • HappyAddons for Elementor 3.16.3
  • HappyAddons for Elementor 3.16.4
  • HappyAddons for Elementor 3.16.5
  • HappyAddons for Elementor 3.17.0
  • HappyAddons for Elementor 3.18.0
  • HappyAddons for Elementor 3.18.1
  • HappyAddons for Elementor 3.19.0
  • HappyAddons for Elementor 3.20.0
  • HappyAddons for Elementor 3.20.1
  • HappyAddons for Elementor 3.20.2
  • HappyAddons for Elementor 3.20.3
  • HappyAddons for Elementor 3.20.4