The Ditty plugin for WordPress suffers from a missing authorization check (CWE-862) in its ditty_init AJAX endpoint. Unlike the non-AJAX init() function, init_ajax() fails to verify that the requested Ditty post has a 'publish' status before returning its content. This allows unauthenticated users to enumerate integer post IDs and retrieve full content of non-public Ditty items such as drafts, pending, scheduled, and disabled entries. The vulnerability affects all versions up to and including 3.1.65 and is publicly documented with a CVSS 3.1 score of 7.5, indicating high impact on confidentiality.

An attacker without any authentication can retrieve full content of non-public Ditty items, including drafts and disabled entries, which may contain sensitive or confidential information. This results in a confidentiality breach. There is no impact on integrity or availability reported. No known exploits in the wild have been documented at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected AJAX endpoint if possible or implement additional access controls at the web server or application firewall level to prevent unauthenticated access to ditty_init AJAX requests.