Wordpress Alert: Private post access bypass

What it looks like

A route or plugin reveals a post marked private to an unauthorized visitor.

Why it matters

Restricted content becomes publicly accessible.

What to check

Test private content through REST, search, feeds, and plugin endpoints while signed out.

Documentation

This is an exploit pattern to check in installed components, not a claim that every WordPress site has this flaw. Confirm the product and version against its advisories before treating a site as affected. See WordPress REST endpoint permissions, WordPress roles and capabilities.