security: add capability check to autocomplete ajax endpoint

Author: dannyvankooten

src/admin/class-autocomplete.php

@@ -18,6 +18,10 @@ public function init(): void
      */
     public function ajax(): void
     {
+        if (! current_user_can('edit_box')) {
+            wp_die('', '', [ 'response' => 403 ]);
+        }
+
         $q    = ( isset($_GET['q']) ) ? sanitize_text_field($_GET['q']) : '';
         $type = ( isset($_GET['type']) && in_array($_GET['type'], [ 'page', 'post', 'category', 'post_type', 'post_tag' ], true) ) ? $_GET['type'] : 'post';