CVE-2024-12102: 
WordPress vulnerability analysis and mitigation

The Typer Core plugin for WordPress contains an Information Exposure vulnerability (CVE-2024-12102) affecting all versions up to and including 1.9.6. The vulnerability was discovered and disclosed on January 30, 2025, and the plugin has been temporarily closed pending a full review as of January 29, 2025 (WordPress Plugin, NVD Database).

The vulnerability exists in the 'elementor-template' shortcode functionality due to insufficient restrictions on which posts can be included. The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The weakness has been classified as CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD Database).

The vulnerability allows authenticated attackers with Contributor-level access or higher to extract data from private or draft posts created by Elementor that they should not have access to. This represents a significant information disclosure risk for sites using the affected plugin versions (NVD Database).

As of January 29, 2025, the plugin has been temporarily closed and is not available for download pending a full security review (WordPress Plugin).