The Post Lockdown plugin for WordPress is vulnerable to information exposure due to insufficient authorization (CWE-862) on the 'pl_autocomplete' AJAX action. Authenticated users with Subscriber-level or higher privileges can retrieve content from posts that should be locked, including password-protected, private, or draft posts. This allows the disclosure of confidential post data.

The affected product is the WordPress plugin Post Lockdown by Andyexeter. All versions up to and including 4.0.2 of the plugin are affected. The vulnerability resides specifically in the plugin’s handling of AJAX requests. The common platform enumeration indicates it runs on the WordPress CMS.

The CVSS score is 4.3, indicating moderate impact, and the EPSS score is less than 1%, showing a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated at least with Subscriber role to exploit it, which suggests that the exploit requires an existing credential and the ability to perform AJAX calls against the site’s admin area. If an attacker gains or steals Subscriber credentials, they can easily request the 'pl_autocomplete' endpoint and read the hidden post contents.