CVE-2024-10796

The If-So Dynamic Content Personalization plugin for WordPress contains an information exposure flaw affecting versions through 1.9.2.1 in the 'ifso-show-post' shortcode, which lacks adequate access controls for post retrieval. Authenticated users with Contributor-level permissions or higher can exploit this vulnerability to access and retrieve content from private or draft posts created with Elementor that would normally be restricted from their view. The flaw requires user authentication but allows unauthorized data disclosure of protected content. The vulnerability was remedied in version 1.9.2.2.

Based on public CVE data (MITRE/NVD).