The Content Views WordPress plugin, versions prior to 4.5, fails to enforce an authorization check on the AJAX action preview_request and also fails to sanitize incoming data before using it in a database query. This omission allows any authenticated user—including those with the Subscriber role—to inject arbitrary SQL statements. The injected code can read, modify, or delete database contents, jeopardizing the confidentiality and integrity of the site’s data. This flaw corresponds to CWE‑89 (SQL Injection).

Any website that has installed the Content Views plugin below version 4.5 is vulnerable. The plugin is a generic WordPress add‑on identified as Content Views, and all installations of the plugin with a version number less than 4.5 are affected, regardless of other configurations or plugins.

The vulnerability is exploitable via an AJAX request that does not validate the user’s privilege level, so an attacker must first authenticate with the site. Because any authenticated user, including low‑privilege Subscribers, can trigger the flaw, widespread exploitation is possible without needing administrative access. The CVSS score of 8.1 indicates a high severity, and the EPSS score of <1% suggests a low probability of exploitation at present, although the flaw is not listed in CISA's KEV catalogue. The lack of an authorization check combined with SQL injection indicates a high potential for damage if an attacker gains any account access.