The QQWorld Auto Save Images plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the save_remote_images_get_auto_saved_results() function. This function is hooked to an AJAX action that does not require any privileges, enabling unauthenticated users to retrieve data from posts that are not intended to be publicly accessible. The vulnerability affects all versions up to and including 1.9.8. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low complexity, no privileges required, no user interaction, and impact limited to confidentiality loss without integrity or availability impact.

An unauthenticated attacker can exploit this vulnerability to access the contents of arbitrary WordPress posts that are not publicly available. This results in unauthorized disclosure of potentially sensitive information. There is no impact on data integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are provided by the vendor at this time. Users should monitor the vendor advisory for updates and apply any official patches once available. Until then, consider restricting access to AJAX endpoints or disabling the plugin if unauthorized data exposure is a concern.