{"id":"CVE-2024-10695","aliases":["EUVD-2024-33250","GHSA-h2f7-qhqc-h8gv"],"status":"published","title":"Futurio Extra \u003c= 2.0.13 - Authenticated (Contributor+) Post Disclosure","description":"The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts that they should not have access to.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00309,"percentile":0.2402,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2024-11-12T03:24:57Z","modified":"2026-06-17T06:56:12Z","products":[{"vendor":"futuriowp","product":"futurio extra"},{"vendor":"futuriowp","product":"futurio_extra"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53871750-6437-459f-97e1-5cf524160f09?source=cve","tags":["Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3184380%40futurio-extra\u0026new=3184380%40futurio-extra\u0026sfp_email=\u0026sfph_mail=#file3","tags":["Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10695"},{"url":"https://github.com/advisories/GHSA-h2f7-qhqc-h8gv"}],"sources":{"cve":[{"id":"CVE-2024-10695","title":"Futurio Extra \u003c= 2.0.13 - Authenticated (Contributor+) Post Disclosure","description":"The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts that they should not have access to.","status":"published","published":"2024-11-12T03:24:57.46Z","modified":"2026-04-08T16:53:06.162Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:34:02.321514Z"}],"euvd":[{"id":"EUVD-2024-33250","description":"The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts that they should not have access to.","status":"published","published":"2024-11-12T03:24:57Z","modified":"2026-04-08T16:53:06Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:58.604017Z"}],"ghsa":[{"id":"GHSA-h2f7-qhqc-h8gv","title":"The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up...","description":"The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts that they should not have access to.","status":"published","published":"2024-11-12T06:30:34Z","modified":"2024-11-12T06:30:40Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:58:46.999726Z"}],"nvd":[{"id":"CVE-2024-10695","description":"The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts that they should not have access to.","status":"published","published":"2024-11-12T04:15:04.61Z","modified":"2026-06-17T06:56:12.643Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:10:36.931115Z"}]}}