LY Corporation: See drafts and post articles if the account owner hasn't set password (livedoor CMS plugin)

For new accounts that haven't set passwords yet, an attacker is able to see drafts or post articles as victims...