Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relations

Secure Custom Fields 6.9.2 registers UNAUTHENTICATED (wp_ajax_nopriv_) AJAX query handlers for the post_object, relationship, and page_link field types. These handlers run a WP_Query whose post_status defaults to "any" with no capability / perm filtering, so they return draft, pending, private, and …