This is a security release that fixes a vulnerability where logged-in “Author” and “Contributor” users could add a Query Loop block with a post status other than “publish” to see draft/private posts.
- Security: Add user capability check to Query Loop post status