CVE-2025-15525 is an incorrect authorization vulnerability (CWE-863) in the Ajax Load More – Infinite Scroll, Load More, & Lazy Load WordPress plugin by dcooney. The issue resides in the parse_custom_args() function, which fails to properly restrict access to certain post data. As a result, unauthenticated attackers can retrieve titles and excerpts of posts that are private, draft, pending, scheduled, or trashed. This affects all plugin versions up to and including 7.8.1. The vulnerability is remotely exploitable without authentication and requires low attack complexity. Confidentiality impact is limited to information disclosure of post metadata; integrity and availability are not affected.

An attacker can gain unauthorized read access to sensitive post metadata such as titles and excerpts of non-public posts (private, draft, pending, scheduled, trashed). This information disclosure could lead to leakage of unpublished or sensitive content. There is no impact on data integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the Ajax Load More plugin or applying custom access controls to limit exposure. Monitor vendor channels for updates and apply patches promptly once available.