Polylang < 3.8.6 - Contributor+ Private Post Disclosure via Row Update AJAX Actions

Description

The plugin does not verify that the requesting user is permitted to read the posts and terms it renders in its row-update AJAX responses. The handlers collected caller-supplied IDs and rendered each record through the list-table row renderer without any post-status or capability filtering, so a user with Contributor-level access and above could obtain the rendered rows of posts they are not entitled to read, including private ones.