wp-ajax-nopriv-visibility

To secure unauthenticated WordPress AJAX endpoints, parse wp_ajax_nopriv_ handlers to identify WP_Query arguments built from user input, strip dangerous keys like post_status and perm, and default post_status to publish. This prevents anonymous users from accessing draft or private content.

Your wp_ajax_nopriv handler exposes draft posts because WP_Query arguments are built directly from client input without sanitization. Removing dangerous query keys like post_status, perm, and suppress_filters, while enforcing safe defaults, prevents this unauthorized content exposure.

The best way to audit WordPress AJAX endpoints for private content leaks is to scan for wp_ajax_nopriv_ handlers that parse client query strings and check for indicators of widened visibility, ensuring any widened post_type whitelists are strictly server-trusted.

You can use WP_Query in plugins without authentication safely by applying a hardening patch pattern that removes dangerous keys, safely defaults post_status to publish, and carefully treats post_type parameters to prevent exposing private, draft, or trashed content.

To patch a WordPress AJAX endpoint against WP_Query visibility exploits, strip dangerous input keys like post_status and suppress_filters, enforce publish as the default post_status, and validate post_type against a strict server-side whitelist to ensure narrowing keys are preserved.

When hardening wp_ajax_nopriv endpoints that require widened visibility, the limitation is that any necessary post_type widening must use strictly server-trusted whitelists, ensuring narrowing keys are preserved and regression checks validate that private content remains inaccessible to anonymous users.