Executive brief
Content Views is a popular WordPress plugin that allows website administrators to create customizable views of posts and pages. The plugin fails to verify user permissions when serving post content through its view shortcodes and AJAX endpoints, allowing unauthenticated visitors to read the full content of draft, pending, private, and scheduled posts if a view is configured to include them. An attacker can exploit this by directly calling the plugin's AJAX handler with a view ID to bypass all access controls and extract sensitive unpublished content.
Technical details
This is an authorization bypass vulnerability (CWE-200) in the Content Views plugin's AJAX pagination handler. The vulnerable component fails to check user capabilities before returning post content from a view, even when those posts are in non-public status (draft, pending, private, scheduled). An unauthenticated attacker can send a POST request to wp-admin/admin-ajax.php with the action parameter set to "pagination_request" and a valid view ID (obtainable from page source HTML or admin screens) to retrieve the rendered HTML containing titles, permalinks, and body content of restricted posts. No authentication, cookies, or nonce validation is required. The vulnerability affects all versions before 4.5.1.2, and a fix has been released in that version. The attack vector is network-based and requires only knowledge of or ability to discover a view ID.
Affected products
- Elementor Content Views before 4.5.1.2
Timeline
- 2026-09-02: disclosed
- 2026-09-04: patched: Version 4.5.1.2 released