MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure

Description The plugin does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts. The fix made in 2.88.15 is not sufficient as it still allowed any authenticated users, such s subscriber to read arbitrary private and draft posts.

PoC

As an unauthenticated user, view the source of a page containing a Map from the plugin and retrieve the nonce from the mappl10n[‘options’][‘nonce’] JavaScript var, then open the below URL (replacing the oid by the ID or a private or draft post) https://example.com/wp-admin/admin-ajax.php?action=mapp_get_post&amp;oid;=53&amp;nonce;=eef7edf9b9