Posts Page as Draft remains publicly queryable

[Cybr]

When assigning a Posts Page at "WP Admin > Settings > Reading" and afterward setting that page to draft, the page remains publicly queryable. This is possible via the ?page_id= query (not ?p=) and the provisioned slug.

[Cybr]

When adding a preview=true-query, the Posts Page will return a 404 response.

[swissspidy]

Can confirm this.

Any non-empty ?page_id= query var will work if the posts page is a draft.

Only when using ?page_id=<id> will the page title also be displayed.

Added checks in two places where WordPress determines if a page is the posts page:

1. When checking by queried_object_id (used when accessing via permalink)
2. When checking by page_id (used when accessing via ID)

In both cases, we now:

1. Get the actual post object for the page
2. Check if the post exists and is published
3. If the post doesn't exist or isn't published, set a 404 and return early
4. Otherwise, proceed with setting the page as the posts page

Trac ticket: https://core.trac.wordpress.org/ticket/60566