diff --git a/class-settings.php b/class-settings.php
index 3506df7..b40cd22 100644
--- a/class-settings.php
+++ b/class-settings.php
@@ -89,7 +89,6 @@ public function __construct() {
 		Hook_Registry::add_filter( self::$prefix . '_settings_sanitize', array( $this, 'change_settings_on_save' ), 99 );
 		Hook_Registry::add_action( 'admin_menu', array( $this, 'redirect_on_save' ) );
 
-		Hook_Registry::add_action( 'wp_ajax_nopriv_' . self::$prefix . '_taxonomy_search_tom_select', array( __CLASS__, 'taxonomy_search_tom_select' ) );
 		Hook_Registry::add_action( 'wp_ajax_' . self::$prefix . '_taxonomy_search_tom_select', array( __CLASS__, 'taxonomy_search_tom_select' ) );
 	}
 
diff --git a/settings/class-settings-sanitize.php b/settings/class-settings-sanitize.php
index 5ffb614..0ac3879 100644
--- a/settings/class-settings-sanitize.php
+++ b/settings/class-settings-sanitize.php
@@ -175,7 +175,8 @@ public function sanitize_postids_field( $value ) {
 		$ids = array_filter( array_map( 'absint', explode( ',', sanitize_text_field( wp_unslash( $value ) ) ) ) );
 
 		foreach ( $ids as $key => $value ) {
-			if ( false === get_post_status( $value ) ) {
+			// Drop missing posts, and posts the saving user cannot read (CLI and cron have no user).
+			if ( false === get_post_status( $value ) || ( is_user_logged_in() && ! current_user_can( 'read_post', $value ) ) ) {
 				unset( $ids[ $key ] );
 			}
 		}