Ajax Load More – Infinite Scroll, Lazy Load & Load More < 7.8.2 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure

Description

The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_args() function in all versions up to, and including, 7.8.1. This makes it possible for unauthenticated attackers to expose the titles and excerpts of private, draft, pending, scheduled, and trashed posts.