CVE-2024-11181 is an authorization bypass vulnerability in the Greenshift – animation and page builder blocks WordPress plugin. It arises from inadequate access control on the 'wp_reusable_render' shortcode, allowing authenticated users with Contributor or higher privileges to extract content from posts that are password protected, private, or in draft status. This results in unauthorized information disclosure. The vulnerability affects all versions up to and including 9.9.9.3. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, unchanged scope, and limited confidentiality impact.

An attacker with Contributor-level or higher access can bypass intended authorization restrictions to view content from protected or non-published posts. This leads to unauthorized disclosure of potentially sensitive information. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to shortcode usage. Avoid using the 'wp_reusable_render' shortcode with sensitive content if possible.