CVE-2024-12335 is an authorization bypass vulnerability in the Avada (Fusion) Builder plugin for WordPress, affecting all versions up to 3.11.12. The vulnerability arises from insufficient access control in the handle_clone_post() function and the 'fusion_blog' shortcode, enabling authenticated users with contributor-level permissions or higher to extract data from posts that are password protected, private, or in draft status. This is due to improper restrictions on which posts can be included, categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability does not affect availability or integrity but leads to unauthorized information disclosure.

Authenticated users with contributor-level access or above can access content from restricted posts (password protected, private, or draft) that they normally should not be able to view. This results in unauthorized information disclosure. There is no indication of impact on data integrity or availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a fix is available, restrict contributor-level access to trusted users only and monitor for updates from themefusion regarding a security update addressing this vulnerability.