Fixed draft posts page allowed querying

src/wp-includes/class-wp-query.php

@@ -1088,6 +1088,11 @@ public function parse_query( $query = '' ) {
 			}
 
 			if ( 'page' === get_option( 'show_on_front' ) && isset( $this->queried_object_id ) && get_option( 'page_for_posts' ) == $this->queried_object_id ) {
+				$posts_page = get_post( $this->queried_object_id );
+				if ( ! $posts_page || 'draft' == $posts_page->post_status ) {
+					$this->set_404();
+					return;
+				}
 				$this->is_page       = false;
 				$this->is_home       = true;
 				$this->is_posts_page = true;
@@ -1100,6 +1105,11 @@ public function parse_query( $query = '' ) {
 
 		if ( $query_vars['page_id'] ) {
 			if ( 'page' === get_option( 'show_on_front' ) && get_option( 'page_for_posts' ) == $query_vars['page_id'] ) {
+				$posts_page = get_post( $query_vars['page_id'] );
+				if ( ! $posts_page || 'draft' == $posts_page->post_status ) {
+					$this->set_404();
+					return;
+				}
 				$this->is_page       = false;
 				$this->is_home       = true;
 				$this->is_posts_page = true;

tests/phpunit/tests/query/pageForPosts.php

@@ -0,0 +1,54 @@
+<?php
+
+class Tests_Query_PageForPosts extends WP_UnitTestCase {
+
+	private $posts_page_id;
+	public function set_up() {
+		parent::set_up();
+
+		update_option( 'show_on_front', 'page' );
+		$this->posts_page_id = self::factory()->post->create(
+			array(
+				'post_title' => 'blog-page',
+				'post_type'  => 'page',
+			)
+		);
+		update_option( 'page_for_posts', $this->posts_page_id );
+		update_option(
+			'page_on_front',
+			self::factory()->post->create(
+				array(
+					'post_title'   => 'front-page',
+					'post_type'    => 'page',
+					'post_content' => "Page 1\n<!--nextpage-->\nPage 2",
+				)
+			)
+		);
+	}
+
+	/**
+	 * Ensure unpublished posts page returns 404.
+	 *
+	 * @ticket 60566
+	 */
+	public function test_unpublished_posts_page_returns_404() {
+
+		wp_update_post(
+			array(
+				'ID'          => $this->posts_page_id,
+				'post_status' => 'draft',
+			)
+		);
+
+		$q = new WP_Query(
+			array(
+				'pagename' => 'blog-page',
+			)
+		);
+
+		$this->assertTrue(
+			$q->is_404(),
+			'Unpublished posts page with status should return 404'
+		);
+	}
+}