The Ajax Load More plugin for WordPress contains an incorrect authorization check in the parse_custom_args() function. This flaw allows an unauthenticated attacker to retrieve the titles and excerpts of private, draft, pending, scheduled, or trashed posts, exposing sensitive content that should remain hidden. The vulnerability is characterized by a CWE-863 weakness related to Designates Wrong Permission Assessment.

All installations of the dcooney Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin from its inception through version 7.8.1 are impacted. Users who have not upgraded beyond this release are susceptible to this data exposure risk.

The CVSS base score of 5.3 indicates a moderate severity. With an EPSS score of less than 1%, the likelihood of active exploitation at the moment is low, and the vulnerability is not cataloged in CISA’s KEV list. Based on the description, it is inferred that the most probable exploitation pathway involves an unauthenticated HTTP request to the plugin’s endpoint that triggers the flawed authorization logic, enabling the attacker to read protected post metadata.