CVE-2024-10796 is an information exposure vulnerability in the If-So Dynamic Content Personalization plugin for WordPress, affecting all versions up to 1.9.2.1. The issue arises from inadequate access control on the 'ifso-show-post' shortcode, enabling authenticated users with Contributor-level privileges or above to bypass authorization and extract data from private or draft posts created via Elementor. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with Contributor-level access or higher can access private or draft post content that should be restricted, leading to unauthorized information disclosure. There is no impact on data integrity or availability. The exposure is limited to content managed by the plugin and created with Elementor, and requires authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict Contributor-level access to trusted users only and monitor for plugin updates addressing this vulnerability. No official fix or temporary workaround is currently documented.