CVE-2024-10796: 
WordPress vulnerability analysis and mitigation

The If-So Dynamic Content Personalization plugin for WordPress contains a vulnerability (CVE-2024-10796) that affects all versions up to and including 1.9.2.1. The vulnerability was discovered and disclosed on November 20, 2024, and involves information exposure through the 'ifso-show-post' shortcode functionality (NVD CVE).

The vulnerability is classified as an Authorization Bypass Through User-Controlled Key (CWE-639) with a CVSS v3.1 Base Score of 4.3 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, and required low privileges (Wordfence Intel).

The vulnerability allows authenticated attackers with Contributor-level access or higher to extract data from private or draft posts that were created using Elementor, potentially exposing sensitive information they should not have access to (NVD CVE).

The vulnerability can be exploited by authenticated users with Contributor-level privileges or higher through the 'ifso-show-post' shortcode due to insufficient restrictions on which posts can be included (NVD CVE).