The Essential Grid Gallery WordPress Plugin contains a missing authorization vulnerability (CWE-862) in the on_front_ajax_action() function. This flaw permits unauthenticated attackers to retrieve private and password-protected posts, potentially exposing sensitive information. The issue affects all versions up to and including 3.1.1. The CVSS 3.1 base score is 5.3, indicating a medium severity vulnerability exploitable remotely without authentication. No vendor advisory or patch links are currently available, and no known exploits in the wild have been reported.

An attacker can access private and password-protected WordPress posts without authentication, leading to sensitive information exposure. There is no impact on data integrity or availability. The exposure is limited to confidentiality loss of protected content managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the plugin's AJAX endpoints via web application firewall rules or other access controls to limit unauthorized queries. Monitor official ThemePunch communications for updates on patches or mitigations.