CVE-2024-10794 is an authorization bypass vulnerability (CWE-639) in the Boostify Header Footer Builder for Elementor WordPress plugin. The flaw exists in the handling of the 'bhf' shortcode, which lacks proper access control on included posts. As a result, authenticated users with Contributor or higher privileges can retrieve content from private or draft Elementor posts beyond their authorization scope. The vulnerability affects all plugin versions up to and including 1.3.6. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with Contributor-level or higher access can read private or draft post content that should be restricted, leading to unauthorized information disclosure. There is no impact on data integrity or availability. The exposure is limited to users who already have some authenticated access to the WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity involving the 'bhf' shortcode. Avoid using the vulnerable plugin version if possible or disable the shortcode functionality as a temporary workaround.