Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference Fields

Secure Custom Fields reference fields resolve stored post IDs through `acf_get_posts()`, which defaults to `post_status => 'any'` and never checks `read_post`. An unauthenticated caller therefore receives the full `WP_Post` — body, excerpt, author, timestamps, permalink and plaintext …