Skip to content
Sign in
5.3 Medium

CVE-2026-17517 The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to…

Description

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them.

Affected products and versions

Product Affected versions Fixed in
Content Views 4.5 earliest → < 4.5.1.2 4.5.1.2

Other CVEs of Content Views

The 2 CVEs of Content Views →
CVE-2026-15361 The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does… 8.1 High
Track this CVE