Unauthenticated post disclosure via post_status query parameter

Authorization bypass in Relevanssi before 4.22.0 and Relevanssi Premium before 2.25.0 allows remote attackers to read nonpublic posts. The search request handler accepts attacker-controlled post_status query values and uses them to include draft or private entries in results. No authentication or user interaction is required; disclosure is limited to indexed draft and private post content returned by search.