@[email protected] I agree that you want to ensure this for your private data. Thus it does require a privacy plugin that doesn’t leak information indeed, for example that also restricts the REST endpoints. I believe that if there was a bit of a movement, a “best privacy plugin” would […]

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/friends/friends-321-missing-authorization and the WordPress.org directory pulled it because of it, in my eyes a bit of an overreaction but well…