CVE-2024-10795 affects the Popularis Extra WordPress plugin (themes4wp) in all versions up to and including 1.2.7. The vulnerability arises from improper authorization checks in the 'elementor-template' shortcode, allowing authenticated users with Contributor-level permissions or higher to access private or draft Elementor posts that should be restricted. This is an information exposure vulnerability categorized as CWE-639. The CVSS 3.1 base score is 4.3 (medium), reflecting a network attack vector with low complexity and requiring low privileges but no user interaction. There is no indication of an official patch or vendor advisory at this time.

An authenticated attacker with Contributor or higher privileges can bypass intended authorization controls to read private or draft posts created via Elementor. This leads to unauthorized information disclosure but does not affect integrity or availability. The impact is limited to data confidentiality within the WordPress environment where the plugin is installed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access or higher to trusted users only. Monitor for updates from themes4wp regarding patches or updates addressing this vulnerability.