The Related Posts By PickPlugins WordPress plugin suffers from an improper access control vulnerability (CWE-284) in its AJAX handler wp_ajax_nopriv_related_post_ajax_get_post_ids. This flaw permits unauthenticated users to retrieve sensitive information such as titles of draft posts. The vulnerability affects all versions up to and including 2.0.58. The CVSS 3.1 base score is 5.3, reflecting a medium severity impact with network attack vector, no privileges required, and no user interaction needed. No known exploits are reported in the wild, and no official patch or vendor advisory is currently available.

An unauthenticated attacker can extract sensitive information from the affected WordPress plugin, specifically the titles of posts that are still in draft status. This exposure could lead to information leakage that may aid further attacks or reveal confidential editorial content. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the affected AJAX action if possible, or temporarily deactivate the plugin to prevent information leakage.