CVE-2024-10356 is a sensitive information exposure vulnerability (CWE-200) in the ElementsReady Addons for Elementor plugin for WordPress. The issue exists in the file inc/Widgets/accordion/output/content.php and affects all versions up to and including 6.4.8. Authenticated attackers with Contributor-level privileges or higher can extract private, pending, and draft template data that should not be accessible to them. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity level. There is no indication of known exploits in the wild or an official patch available at this time.

An attacker with Contributor-level or higher access can retrieve sensitive template data that is private, pending, or in draft status. This exposure could lead to unauthorized disclosure of information that may be intended to remain confidential within the WordPress environment. The vulnerability does not affect system integrity or availability, only confidentiality to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for any suspicious activity related to template data access. Avoid granting Contributor or higher privileges to untrusted users.