CVE-2024-10536 is a missing authorization vulnerability (CWE-862) in the FancyPost – Post Blocks, Grids & Sliders for Block Editor and Elementor WordPress plugin by wpqode. The issue arises from the absence of a capability check in the handle_block_shortcode_export() function, enabling authenticated users with Subscriber-level privileges or higher to export shortcodes without proper authorization. This vulnerability affects all plugin versions up to 6.0.0 and is classified with a CVSS 3.1 base score of 4.3 (medium severity). No patches or vendor advisories have been provided to date.

Authenticated users with Subscriber-level access or above can export shortcodes without authorization, potentially leading to unauthorized data exposure related to shortcode content. There is no indication of confidentiality, availability, or integrity impact beyond this unauthorized information access. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals and monitor plugin updates from wpqode for a security patch addressing this missing authorization vulnerability.