A recent WordPress plugin, Locker Content, includes an AJAX endpoint named 'lockerco_submit_post' that is accessible without authentication. This endpoint returns the full content of posts that have been protected by the plugin, allowing an attacker to enumerate and download confidential information from a site. The vulnerability is a direct information disclosure weakness, classified under CWE‑200. When exploited, the attacker can read any protected post, potentially revealing private data, intellectual property, or sensitive user content.

The affected product is the Locker Content plugin for WordPress, provided by appglut. Version 1.0.0, as released and listed by the CNA, is vulnerable. Any WordPress site running this version and exposing the AJAX endpoint is at risk.

The CVSS score of 5.3 indicates moderate severity, and an EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to discover the site URL and then send a simple, unauthenticated POST request to the AJAX endpoint, which is a web‑reachable vector. Because the error does not require elevated privileges, the attack could be executed from any network with access to the public site. The overall risk is moderate in impact, but the probability of exploitation is currently low.