Vulnerability · Published Sep 4, 2026 · Assigned by WPScan
CVE-2026-17517Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter
Medium 5.3
In plain English
A medium-severity information exposure in Content Views from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 71.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Content Views | 0 – before 4.5.1.2 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://wpscan.com/vulnerability/abd82cce-9652-4598-b830-0b08fe3c334b/ exploit, vdb-entry, technical-description