The Shortcodes for Elementor plugin for WordPress contains an authorization bypass vulnerability (CWE-639) in all versions up to 1.0.4. The issue arises because the 'SHORTCODE_ELEMENTOR' shortcode does not properly restrict which posts can be included, allowing authenticated users with Contributor-level privileges or above to extract data from private and draft posts created with Elementor. This vulnerability leads to unauthorized information disclosure but does not affect integrity or availability. The CVSS 3.1 base score is 4.3, reflecting a medium severity impact with network attack vector, low attack complexity, and requiring privileges.

Authenticated users with Contributor-level access or higher can access private and draft post content that should be restricted, resulting in unauthorized information disclosure. There is no indication of impact on data integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Shortcodes for Elementor plugin if private content confidentiality is critical.