wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.
http://www.cvedetails.com/cve/CVE-2011-0701/
http://core.trac.wordpress.org/changeset/17393
This vulnerability affects the following application versions:
- WordPress 3.0
- WordPress 3.0.1
- WordPress 3.0.2
- WordPress 3.0.3
- WordPress 3.0.4