CVE-2024-7063 is a sensitive information exposure vulnerability in the ElementsKit Pro WordPress plugin affecting all versions up to 3.6.6. The flaw exists in the 'render_raw' function, which improperly allows authenticated users with Contributor-level permissions or above to extract sensitive content such as private, future, and draft posts. The vulnerability has a CVSS v3.1 base score of 4.3 (medium severity) with network attack vector, low attack complexity, and requiring privileges. No integrity or availability impact is indicated.

An authenticated user with Contributor-level permissions or higher can access sensitive content that should be restricted, including private, future, and draft posts. This could lead to unauthorized disclosure of unpublished or confidential information within the WordPress site. There is no indication of impact on data integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level permissions to trusted users only and monitor for suspicious activity. Avoid granting Contributor or higher privileges to untrusted users. Review plugin updates regularly for a patch addressing this vulnerability.