The vulnerability CVE-2024-10319 in the Xpro Addons — 140+ Widgets for Elementor plugin arises from improper access control in the render function located in widgets/content-toggle/layout/frontend.php. Authenticated users with Contributor or higher privileges can exploit this to access sensitive template data that should be restricted, including private, pending, and draft content. The CVSS 3.1 base score is 4.3 (medium), reflecting the network attack vector, low complexity, and limited confidentiality impact without integrity or availability effects. No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

An attacker with Contributor-level or higher access can retrieve sensitive template data that is not intended to be publicly accessible. This exposure could lead to information disclosure risks within the affected WordPress environment. There is no indication of impact on data integrity or service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for plugin updates. Avoid granting unnecessary privileges that could be leveraged to exploit this vulnerability.