I have a customer claiming that a page that is marked as private under WordPress showed up on Google search.
The page showed up on Google search, but when the user reached the page, it returned a 404 not found (as it should).
Is this possible?
Unless something (a theme, plugin, etc) has changed how that installation of WordPress works, a page published as private should not be viewable unless the visitor is logged in as editor or admin, as per the WordPress docs:
Private content is published only for your eyes, or the eyes of only those with authorization permission levels to see private content. Normal users and visitors will not be aware of private content. It will not appear in the article lists. If a visitor were to guess the URL for your private post, they would still not be able to see your content. You will only see the private content when you are logged into your WordPress blog. ... Private posts are automatically published but not visible to anyone but those with the appropriate permission levels (Editor or Administrator).
https://codex.wordpress.org/Content_Visibility#Private_Content
If you can view the page without being logged in as editor/admin, then Google can see it too, and you'd need to check the theme/plugins to see which one is causing the problem.