CVE-2024-10778 is an authorization bypass vulnerability (CWE-639) in the BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress. The flaw exists because the 'elementor-template' shortcode does not properly restrict which posts can be included, enabling authenticated users with Contributor or higher privileges to extract data from private or draft Elementor posts they normally should not access. The vulnerability affects all versions up to and including 1.7.4. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low impact on confidentiality and no impact on integrity or availability. There are no known exploits in the wild and no patch or official fix information provided in the data.

An attacker with Contributor-level or higher access can read private or draft posts created by Elementor that they are not authorized to view. This results in unauthorized information disclosure but does not allow modification or denial of service. The impact is limited to confidentiality loss of certain WordPress post content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity involving the 'elementor-template' shortcode. Avoid exposing sensitive content in private or draft posts accessible via this plugin.