The Shortcodes and extra features for Phlox theme plugin for WordPress allows unauthenticated users to retrieve the titles of draft posts through the auxels_ajax_search AJAX endpoint. An attacker can issue a simple HTTP request to the endpoint, observe the response, and capture the draft titles that should remain private. This vulnerability is a classic information‑exposure flaw (CWE-200) that can reveal sensitive development content to anyone on the internet.

WordPress sites running the Averta "Shortcodes and extra features for Phlox theme" plugin version 2.17.13 or earlier are affected. The flaw resides in the AJAX handler included in the plugin’s public sources and is not limited by authentication or user role checks.

The CVSS base score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% reflects a low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. Attackers can exploit the flaw remotely without credentials by simply sending a request to the auxels_ajax_search endpoint, meaning successful exploitation is straightforward for motivated adversaries. Nonetheless, the path to compromise is limited to the AJAX request and the data exposed is only draft post titles, not full content.