CVE-2024-10695 is an authorization bypass vulnerability in the Futurio Extra WordPress plugin (versions up to 2.0.13). The vulnerability arises from inadequate access control on the 'elementor-template' shortcode, allowing authenticated users with Contributor or higher privileges to retrieve content from private or draft posts they normally cannot access. This is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges but no user interaction, impacting confidentiality only.

An attacker with Contributor-level or higher access can expose confidential content from private or draft posts by exploiting the shortcode's insufficient access restrictions. This leads to unauthorized information disclosure but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a fix is available, limit Contributor-level access to trusted users only and monitor for plugin updates from the vendor addressing this vulnerability.