The Dollie AI – Connect plugin for WordPress contains an authorization bypass vulnerability (CWE-639) in all versions up to 6.2.0 via the 'elementor-template' shortcode. This flaw allows authenticated users with Contributor or higher privileges to extract information from posts that are password protected, private, or in draft status, bypassing intended access controls. The vulnerability arises from insufficient restrictions on which posts can be included by the shortcode, enabling unauthorized data exposure.

The vulnerability allows unauthorized disclosure of content from restricted WordPress posts (password protected, private, or draft) to authenticated users with Contributor-level access or above. This could lead to exposure of sensitive or confidential information that should be inaccessible to these users. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and monitor for any suspicious activity related to the 'elementor-template' shortcode usage. Avoid using the affected shortcode if possible.