CVE-2026-17517: Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter
The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Content Views pluginto a version that resolves this vulnerability.Fixed in 4.5.1.2
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated disclosure?
Sites using a version of the Content Views WordPress plugin before 4.5.1.2 are exposed when they have a view configured to include non-public post statuses. The affected statuses include draft, pending, private, and scheduled posts.
What does an attacker need to exploit this issue?
An attacker does not need to authenticate. They need a view that has been configured to return non-public posts, because the plugin does not verify that the requester is authorized to read those posts.
What information can be disclosed?
An unauthenticated requester can obtain the title and content of non-public posts returned by an affected view.