CVE-2024-10690 MEDIUM

CVE-2024-10690: Shortcodes for Elementor <= 1.0.4 - Authenticated (Contributor+) Post Disclosure

Vendor Rstheme2017

Product Shortcodes for Elementor

Weakness CWE-639 · IDOR

Published December 14, 2024

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The Shortcodes for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.4 via the 'SHORTCODE_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created with Elementor that they should not have access to.

Key dates

02Disclosure timeline

December 14, 2024 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-10690 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Related vulnerabilities

04Related CVE

CVE-2025-67985 WordPress Document Library Lite plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability CVE-2021-21324 Insecure Direct Object Reference (IDOR) on "Solutions" CVE-2025-41358 Direct reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2A CVE-2024-13841 Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time <= 1.0.0 - Authenticated (Contributor+) Post Disclosure CVE-2023-0689 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode