CVE-2024-12447 is an insecure direct object reference vulnerability (CWE-639) in the Get Post Content Shortcode WordPress plugin. The vulnerability arises from inadequate validation of a user-controlled key parameter in the 'post-content' shortcode, enabling authenticated users with Contributor or higher privileges to bypass authorization controls and access restricted post content, including password-protected, private, draft, and pending posts. This issue affects all versions up to 0.4 and has a CVSS 3.1 base score of 4.3, indicating medium severity. No patches or official fixes have been documented as of the published date.

Authenticated users with Contributor-level or higher privileges can read sensitive post content that should be restricted, such as password-protected, private, draft, and pending posts. This unauthorized disclosure of content could lead to information leakage within the affected WordPress environment. There is no reported impact on integrity or availability, and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Get Post Content Shortcode plugin if sensitive content exposure is a concern. Monitor vendor channels for updates regarding patches or official mitigations.