CVE-2025-1504 describes a missing authorization vulnerability (CWE-862) in the Post Lockdown plugin for WordPress, affecting all versions up to and including 4.0.2. The issue arises from insufficient restrictions on the 'pl_autocomplete' AJAX action, allowing authenticated users with Subscriber-level privileges or above to retrieve information from posts that are password protected, private, or drafts. This leads to unauthorized information disclosure without impacting data integrity or availability. The CVSS 3.1 base score is 4.3 (medium severity), reflecting a network attack vector with low complexity and requiring low privileges but no user interaction.

The vulnerability allows unauthorized disclosure of content from restricted posts (password protected, private, or drafts) to authenticated users with Subscriber-level access or higher. There is no impact on data integrity or availability. No known exploits are reported in the wild at this time.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should consider restricting Subscriber-level access or disabling the Post Lockdown plugin if sensitive content exposure is a concern.