The plugin does not ensure that users making. alive search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink
http://example.com/wp-admin/admin-ajax.php?action=searchwp_live_search&swpquery=a&post_status=draft