Content Views CVE-2026-15361

Exploitation requires a valid WordPress account at the Subscriber role or higher (PR:L per CVSS) - this is the single binding prerequisite. The Content Views plugin must be installed and active in any version prior to 4.5. The vulnerable code path is an AJAX action registered by the plugin and exposed at wp-admin/admin-ajax.php; no special Content Views feature or non-default configuration needs to be enabled beyond plugin activation. Sites with open user registration are most exposed because attackers can self-provision the required account with no human gating. Sites that disable open registration or require administrator approval for new accounts are meaningfully protected, since account acquisition becomes the binding bottleneck. No special server-side configuration, specific PHP settings, or particular Content Views view type is required - plugin presence alone is sufficient.

The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects a network-reachable, low-complexity flaw requiring only Subscriber-level access, with high confidentiality and integrity impact and no availability impact. The PR:L metric is the key risk moderator - mass exploitation requires a valid WordPress account, which limits fully automated drive-by attacks; SSVC's Automatable:no and the 6th-percentile EPSS (0.16%) corroborate this. However, SSVC rates technical impact as total, consistent with unrestricted database read and write via SQL injection, and a POC is publicly available from WPScan, which meaningfully elevates urgency beyond what the EPSS alone suggests. The divergence between low EPSS and high technical impact is best explained by the authentication prerequisite - sites permitting open user registration are at substantially higher risk, as the binding constraint is trivially removed. No conflicts between data sources were identified; all signals are internally consistent.

An attacker registers a free Subscriber account on any WordPress site running Content Views below version 4.5 with open user registration enabled, then issues a crafted HTTP POST to wp-admin/admin-ajax.php targeting the plugin's unprotected AJAX action with a SQL injection payload embedded in an unsanitized parameter. A publicly available POC from WPScan lowers the skill threshold significantly. Through successive injected queries the attacker can dump the full WordPress database, including password hashes, email addresses, session tokens, and plugin configuration, or directly modify database content to escalate privileges or inject malicious data.