The RTMKit WordPress plugin versions prior to 2.0.9 contain an authorization bypass vulnerability (CWE-639) due to missing capability checks in an AJAX action. This flaw permits users with at least Contributor privileges to access the titles of posts they should not normally view, including private, draft, pending, scheduled, and trashed posts belonging to other users. The vulnerability stems from the plugin directly using a user-supplied post identifier without verifying the user's permission to access that post.

Users with Contributor role or higher can read the titles of other users' posts that are private, drafts, pending, scheduled, or trashed. This could lead to unauthorized disclosure of sensitive post metadata, potentially exposing information about unpublished or restricted content. There is no indication of code execution or data modification beyond reading post titles.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 2.0.9, upgrading to version 2.0.9 or later (if available) is recommended once confirmed. Until a patch is available, restrict Contributor role capabilities or disable the vulnerable AJAX action if possible.