CVE-2026-17517CWE-200information-disclosure

CVE-2026-17517

Medium · published September 4, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
10.1
In the wild
Unconfirmed
What it is

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00206 · 10.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-09-04T11:17Z
References (1)
https://wpscan.com/vulnerability/abd82cce-9652-4598-b830-0b08fe3c334b/ · [email protected]
EPSS history
Timeline
  • 05 SEP 03:40Z
    EPSS moved — → 0%
    epss
  • 04 SEP 06:00Z
    Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter
    cvelistv5