CVE-2024-13832 affects the Ultra Addons Lite for Elementor WordPress plugin, allowing authenticated users with Contributor-level privileges or above to bypass authorization controls via the 'ut_elementor' shortcode. This flaw permits unauthorized reading of content from password protected, private, or draft posts due to inadequate validation of post inclusion permissions. The vulnerability is categorized under CWE-639, highlighting an authorization bypass through user-controlled keys. The CVSS 3.1 score of 4.3 reflects a network attack vector with low complexity and low privileges required, resulting in limited confidentiality impact. No patch or official remediation guidance is currently available from the vendor, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

An attacker with Contributor-level or higher access can extract sensitive content from posts that should be restricted, including password protected, private, or draft posts. This leads to unauthorized information disclosure but does not affect data integrity or availability. The confidentiality impact is limited but significant for environments where sensitive content is stored in restricted posts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Ultra Addons Lite for Elementor plugin if sensitive content exposure risk is unacceptable. Monitor for vendor updates addressing this vulnerability.