The Full Screen Menu for Elementor plugin suffers from an authorization bypass vulnerability (CWE-639) in all versions up to 1.0.7. This flaw arises because the plugin does not properly restrict which posts can be included via the Full Screen Menu Elementor Widget, enabling authenticated users with contributor or higher privileges to extract data from private or draft posts created with Elementor that they normally would not have permission to access. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges but no user interaction, impacting confidentiality only.

An attacker with contributor-level or higher access to the WordPress site can exploit this vulnerability to view private or draft post content that should be restricted, leading to unauthorized information disclosure. There is no impact on data integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a patch is released, restrict contributor-level access where possible and review user permissions to minimize exposure.