The Typer Core plugin for WordPress suffers from an authorization bypass vulnerability (CWE-639) in all versions up to and including 1.9.6. The issue arises from inadequate restrictions on which posts can be included via the 'elementor-template' shortcode. Authenticated attackers with Contributor-level privileges or above can exploit this to extract data from private or draft posts created by Elementor, which normally should be inaccessible to them. The CVSS 3.1 base score is 4.3 (medium), reflecting the network attack vector, low complexity, and limited confidentiality impact without integrity or availability effects. No official patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

An attacker with Contributor-level or higher WordPress access can read private or draft Elementor posts that should be restricted, leading to unauthorized information disclosure. There is no impact on data integrity or availability. The vulnerability does not allow unauthenticated access and requires at least Contributor privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the 'elementor-template' shortcode if feasible. Monitor for vendor updates regarding an official fix.