The vulnerability CVE-2024-10050 in brainstormforce's Ultimate Addons for Elementor allows authenticated users with Contributor or higher privileges to access sensitive content of Draft, Private, and Password-protected posts via the hfe_template shortcode. This exposure of sensitive information (CWE-200) occurs in all versions up to 1.6.43 of the Elementor Header & Footer Builder plugin. The attack vector requires network access and low complexity with no user interaction needed beyond authentication. The impact is limited to confidentiality with no integrity or availability impact. No vendor advisory or patch information is currently provided.

An authenticated user with Contributor-level access or above can view content they should not have access to, including Draft, Private, and Password-protected posts owned by other users. This leads to unauthorized disclosure of sensitive information. There is no indication of impact on data integrity or system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider limiting use of the hfe_template shortcode. Monitor for updates from brainstormforce regarding patches or official mitigations.