CVE-2024-10782: 
WordPress vulnerability analysis and mitigation

The Theme Builder For Elementor plugin for WordPress contains an Information Exposure vulnerability (CVE-2024-10782) affecting all versions up to and including 1.2.2. The vulnerability was discovered by Francesco Carlucci and publicly disclosed on November 20, 2024 (Wordfence).

The vulnerability exists in the 'elementor-template' shortcode implementation due to insufficient restrictions on which posts can be included. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD).

This vulnerability allows authenticated attackers with Contributor-level access or higher to extract data from private or draft posts created by Elementor that they should not have access to. The impact is limited to information disclosure, with no ability to modify or delete content (NVD).

Users should update to a version newer than 1.2.2 when available. No specific workarounds have been publicly disclosed at this time (NVD).