Post Lockdown WordPress Plugin Information Exposure Vulnerability

A vulnerability allowing information exposure has been identified in the Post Lockdown plugin for WordPress, affecting all versions through 4.0.2. The issue arises from inadequate restrictions on which posts can be included in the 'pl_autocomplete' AJAX action. This flaw enables authenticated attackers with Subscriber-level access and above to access data from password-protected, private, or draft posts that should otherwise be restricted.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive post data, including content from password-protected, private, or draft posts.

Remediation

Users are advised to update the Post Lockdown plugin to version 4.0.3 or a newer patched version.