EUVD-2026-70901
GHSA-99mx-5cm5-w53g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network exploitation requires no attacker complexity; C:L reflects limited post-content disclosure with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them.
AnalysisAI
Unauthenticated information disclosure in the Content Views WordPress plugin before 4.5.1.2 allows any remote visitor to read the title and full body of non-public posts - including drafts, pending, private, and scheduled posts - when a site administrator has configured a view to include them. The root cause is a missing authorization check: the plugin never verifies whether the requesting user holds the WordPress capability required to read posts in restricted statuses before serving them in view responses. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a site administrator to have explicitly configured at least one Content Views 'view' to include posts in a non-public status - specifically draft, pending, private, or scheduled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 (Medium) vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately characterizes the ease of exploitation (no credentials, no complexity, no interaction) while limiting severity to C:L because the exposed data is restricted to post content rather than credentials, session tokens, or system-level material. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Content Views WordPress plugin to version 4.5.1.2 or later via the WordPress admin dashboard or the official plugin repository; this release introduces the missing authorization checks that verify requesting users hold the appropriate capabilities before returning restricted post content. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Content Views
View allSQL injection in the Content Views WordPress plugin before 4.5 exposes the underlying WordPress database to any authenti
The Content Views - Post Grid, Slider, Accordion (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today