CVE-2024-10787 is an authorization bypass vulnerability (CWE-639) in the LA-Studio Element Kit for Elementor WordPress plugin, affecting all versions up to and including 1.4.4. The vulnerability arises from inadequate access control on the 'elementor-template' shortcode, allowing authenticated users with Contributor-level privileges or higher to retrieve data from private and draft Elementor posts they should not access. This results in unauthorized information disclosure. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with Contributor-level or higher access can extract content from private and draft posts created by Elementor that are normally restricted. This leads to unauthorized information disclosure but does not affect integrity or availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Contributor-level access to trusted users only and monitor for suspicious activity related to the 'elementor-template' shortcode usage. Avoid exposing sensitive content in private or draft posts accessible via this plugin.