CVE-2026-17517
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Content Views WordPress plugin before version 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns. This allows unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them.
Risk Assessment
The organization is exposed to leakage of confidential content that should not be publicly accessible, potentially compromising editorial processes and data privacy.
Recommendation
It is recommended to immediately update the Content Views plugin to version 4.5.1.2 or later, which includes the security fix.
Other vulnerabilities in Content Views WordPress plugin
Original NVD description (English source)
The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS