Wordpress Alert: Draft content disclosure

What it looks like

Unpublished drafts appear in a public response or cached page.

Why it matters

Embargoed or incomplete material can leak.

What to check

Inspect REST responses and cache rules for draft and preview content.

Documentation

This is an exploit pattern to check in installed components, not a claim that every WordPress site has this flaw. Confirm the product and version against its advisories before treating a site as affected. See WordPress REST endpoint permissions, WordPress roles and capabilities.