CVE-2024-12061 is an authorization bypass vulnerability (CWE-639) in the Events Addon for Elementor plugin for WordPress. The issue exists in all versions up to and including 2.2.3 and involves the naevents_elementor_template shortcode, which does not properly restrict access to private or draft posts. This allows authenticated users with Contributor-level privileges or above to extract data from posts they are not authorized to access. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. There is no indication of known exploits in the wild or available patches at this time.

An attacker with Contributor-level or higher access can bypass authorization controls to view private or draft posts created by Elementor, potentially exposing sensitive or unpublished content. The impact is limited to confidentiality (information exposure) without integrity or availability effects. The vulnerability does not allow unauthenticated access and requires some level of authenticated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access carefully and monitor user privileges. Avoid granting Contributor or higher roles to untrusted users. Review and limit use of the naevents_elementor_template shortcode if possible.