WordPress: Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relations

The Secure Custom Fields plugin in version 6.9.2 registered unauthenticated AJAX query handlers for the postobject, relationship, and pagelink field types. These handlers ran a WordPress query with the poststatus parameter set to "any", which returned draft, pending, private, and future posts...