From Gentoo bugzilla:

Michael Brooks has discovered a vulnerability in WordPress, which can be
exploited by malicious people to bypass certain security restrictions and to
disclose sensitive information.

The application does not properly restrict access to posted drafts to users
with valid administrator credentials. This can be exploited to read drafts by
accessing the index.php script with data in the "PATH_INFO" URL part ending
with "wp-admin/".

Examples:
http://[host]/[path]/index.php/wp-admin/
http://[host]/[path]/index.php/test-wp-admin/

The vulnerability is confirmed in version 2.3.1. Other versions may also be
affected.

Solution:
Do not post sensitive information as drafts.