{"id":"CVE-2024-10796","aliases":["EUVD-2024-33460"],"status":"published","title":"If-So Dynamic Content Personalization \u003c= 1.9.2.1 - Authenticated (Contributor+) Post Disclosure","description":"The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifso-show-post' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00469,"percentile":0.40889,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2024-11-21T04:24:26Z","modified":"2026-06-17T06:56:27Z","products":[{"vendor":"ifso","product":"if-so dynamic content personalization"},{"vendor":"unknown","product":"if-so dynamic content personalization"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66363035-c09f-4b41-b9fe-2e2bdd851f41?source=cve"},{"url":"https://plugins.trac.wordpress.org/changeset/3188093/if-so/trunk/extensions/ifso-extended-shortcodes/extended-shortcodes.php?old=3157276\u0026old_path=if-so%2Ftrunk%2Fextensions%2Fifso-extended-shortcodes%2Fextended-shortcodes.php"}],"sources":{"cve":[{"id":"CVE-2024-10796","title":"If-So Dynamic Content Personalization \u003c= 1.9.2.1 - Authenticated (Contributor+) Post Disclosure","description":"The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifso-show-post' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.","status":"published","published":"2024-11-21T04:24:26.037Z","modified":"2026-04-08T16:57:57.446Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:34:02.321514Z"}],"euvd":[{"id":"EUVD-2024-33460","description":"The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifso-show-post' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.","status":"published","published":"2024-11-21T04:24:26Z","modified":"2026-04-08T16:57:57Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:55.662835Z"}],"nvd":[{"id":"CVE-2024-10796","description":"The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifso-show-post' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.","status":"published","published":"2024-11-21T11:15:22.99Z","modified":"2026-06-17T06:56:27.397Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:10:37.996328Z"}]}}