The Ajax Load More – Infinite Scroll plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.6.0.2. The plugin's AJAX endpoint (wp_ajax_nopriv_alm_get_posts) allows unauthenticated users to access non-public posts (draft, private, pending, future, trash) by
injecting post_status via the custom_args parameter, which bypasses the post_status authorization check in class-alm-queryargs.php.
登录后查看神龙缓存的 POC 文件快照
登录查看