The Ditty plugin for WordPress suffers from an authorization bypass vulnerability (CWE-862) in all versions up to 3.1.65. The vulnerability arises because the init_ajax() function does not check whether the requested Ditty post has a 'publish' status before returning its content. This contrasts with the non-AJAX init() function, which properly enforces this check. As a result, attackers can enumerate integer post IDs via the ditty_init AJAX endpoint and retrieve full content of non-public Ditty items such as drafts, pending, scheduled, or disabled entries without authentication.

Successful exploitation allows unauthenticated attackers to access sensitive unpublished or disabled content managed by the Ditty plugin. This leads to confidentiality breaches as content intended to remain private can be extracted. There is no indication of impact on integrity or availability. The CVSS v3.1 base score is 7.5, reflecting high severity due to network attack vector, no privileges or user interaction required, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Ditty plugin or restricting access to the ditty_init AJAX endpoint via web server or security controls to prevent unauthorized content enumeration.