diff --git a/wordpress/trunk/mpcx-lightbox.php b/wordpress/trunk/mpcx-lightbox.php
index c0fc662..a8b26e2 100644
--- a/wordpress/trunk/mpcx-lightbox.php
+++ b/wordpress/trunk/mpcx-lightbox.php
@@ -271,6 +271,15 @@ function lightbox_get_image_title() {
 	$options = get_option( 'mpcx_lightbox' );
 	$titleId = intval( $options['title'] );
 	$post    = get_post( intval( $_POST['postId'] ) );
+
+	// Only expose data for publicly visible posts. Without this check the
+	// unauthenticated wp_ajax_nopriv endpoint returns the title, content or
+	// excerpt of ANY post ID - including private, draft, pending, trashed or
+	// password-protected posts - to anonymous visitors (CWE-862 / CWE-200).
+	if ( ! $post || 'publish' !== get_post_status( $post ) || ! empty( $post->post_password ) ) {
+		die( json_encode( '' ) );
+	}
+
 	switch ( $titleId ) {
 		case 1:
 			$title = $post->post_title;