The Content Views WordPress plugin, versions prior to 4.5, fails to enforce an authorization check on the AJAX action preview_request and also fails to sanitize incoming data before using it in a database query. This omission allows any authenticated user—including those with the Subscriber role—to inject arbitrary SQL statements. The injected code can read, modify, or delete database contents, jeopardizing the confidentiality and integrity of the site’s data. This flaw corresponds to CWE‑89 (SQL Injection) and also reflects a weakness in authorization checks (CWE‑639/284).

Any website that has installed the Content Views plugin below version 4.5 is vulnerable. The plugin is a generic WordPress add‑on identified as Content Views, and all installations of the plugin with a version number less than 4.5 are affected, regardless of other configurations or plugins.

The vulnerability is exploitable via an AJAX request that does not validate the user’s privilege level, so an attacker must first authenticate with the site. Because any authenticated user, including low‑privilege Subscribers, can trigger the flaw, widespread exploitation is possible without needing administrative access. The EPSS score is not reported and the flaw is not listed in CISA’s KEV catalogue, but the lack of an authorization check combined with SQL injection suggests a high potential for damage if an attacker gains any account access. No CVSS score is supplied, so the severity can only be inferred from the described impact.