CVE-2024-10670 affects the Primary Addon for Elementor plugin for WordPress, allowing authenticated users with Contributor or higher privileges to bypass authorization controls via the [prim_elementor_template] shortcode. The vulnerability arises from insufficient restrictions on which posts can be included, enabling unauthorized reading of private or draft Elementor posts. This is an authorization bypass vulnerability categorized under CWE-639. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring privileges. No patch or official fix has been documented yet.

An attacker with Contributor-level or higher access can read private or draft posts created with Elementor that they should not be authorized to view. This leads to unauthorized information disclosure but does not affect integrity or availability. The impact is limited to confidentiality loss of restricted post content within the WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the [prim_elementor_template] shortcode if feasible.