CVE-2024-10688 affects the Attesa Extra plugin for WordPress, allowing authenticated users with Contributor or higher privileges to bypass authorization controls through the 'attesa-template' shortcode. The vulnerability arises because the plugin does not properly restrict which posts can be included, enabling unauthorized reading of protected content such as password protected, private, or draft posts. This is an information exposure issue categorized under CWE-639. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring privileges but no user interaction.

An attacker with Contributor-level access or above can extract sensitive information from posts that are intended to be restricted, including password protected, private, or draft posts. This leads to unauthorized information disclosure but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Attesa Extra plugin if sensitive content exposure is a concern.