CVE-2024-10802 is a missing authorization vulnerability in the Hash Elements WordPress plugin (versions up to 1.4.7). The function hash_elements_get_posts_title_by_id() lacks a capability check, enabling unauthenticated users to retrieve draft post titles that should be inaccessible. This exposure of draft titles constitutes a confidentiality breach. The CVSS 3.1 score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality impact.

An unauthenticated attacker can retrieve draft post titles that are normally restricted, leading to partial disclosure of unpublished content titles. This impacts confidentiality but does not affect integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin or disable it if draft post title confidentiality is critical. Monitor for vendor updates regarding a security patch.