CVE-2024-9223 is a missing authorization vulnerability (CWE-862) in the WPDash Notes plugin for WordPress. The issue arises from the lack of a capability check in the 'wp_ajax_post_it_list_comment' function, enabling authenticated users with low privileges (Subscriber and above) to access comments on posts they should not normally view, including private and password-protected posts as well as certain unpublished posts. The vulnerability affects all versions up to and including 1.3.5, with a partial patch applied in version 1.3.5. No full patch or official fix has been confirmed from the vendor advisory or patch links.

An attacker with Subscriber-level access can bypass intended access controls to read comments on restricted posts, potentially exposing sensitive or private information. There is no indication of impact on data integrity or availability. The vulnerability does not allow unauthenticated access, limiting the scope to authenticated users with at least minimal privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was partially patched in version 1.3.5, but no complete fix is confirmed. Until a full patch is available, restrict Subscriber-level user access where possible and monitor for plugin updates from the vendor. Avoid granting Subscriber or higher privileges to untrusted users.