Ajax Load More WordPress Plugin Incorrect Authorization Vulnerability Allowing Unauthorized Access to Private Post Data

A vulnerability exists in the Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress, in all versions through 7.8.1. The issue arises from incorrect authorization in the parse_custom_args() function, allowing unauthenticated attackers to access and expose the titles and excerpts of private, draft, pending, scheduled, and trashed posts.

Impact

Exploitation of this vulnerability leads to unauthorized access and exposure of private, draft, pending, scheduled, and trashed post titles and excerpts.

Remediation

Users can update to version 7.8.2 or a newer patched version to address this vulnerability.