The Easy Twitter Feed WordPress plugin (bplugins Feeds for Twitter – Embed Social Media Posts with Live Updates) contains an information exposure vulnerability (CVE-2024-10666) affecting all versions up to 1.2.6. Authenticated users with Contributor-level permissions or above can exploit the [etf] shortcode to access content from posts that should be restricted, such as password-protected, private, or draft posts. This is due to an authorization bypass via a user-controlled key, classified under CWE-639. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and limited confidentiality impact. There are no known exploits in the wild and no vendor-provided patch or advisory at this time.

The vulnerability allows unauthorized disclosure of content from restricted WordPress posts to authenticated users with Contributor-level access or higher. This could lead to leakage of sensitive or unpublished information that should remain private. There is no indication of integrity or availability impact. The overall impact is limited to confidentiality exposure within the WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Contributor-level access to trusted users only and consider disabling or removing the Easy Twitter Feed plugin if sensitive content confidentiality is critical.