CVE-2024-10692: 
WordPress vulnerability analysis and mitigation

The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress contains an Information Exposure vulnerability (CVE-2024-10692) affecting all versions up to and including 2.8.1. The vulnerability exists in the Content Reveal widget due to insufficient restrictions on post access controls (NVD).

The vulnerability stems from insufficient restrictions in the Content Reveal widget that fails to properly limit access to protected content. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The weakness has been classified as CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD, Wordfence).

The vulnerability allows authenticated attackers with Contributor-level access or higher to extract data from password protected, private, or draft posts that they should not have access to (NVD).

The vulnerability requires an authenticated user with at least Contributor-level privileges to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

Users should upgrade to version 2.8.2 or later of the PowerPack Elementor Addons plugin, which contains fixes for this vulnerability (WordPress).