Description

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-07T06:16:55.577Z",
  "pubdate": "2026-08-07T06:16:55.577Z",
  "executiveSummary": "The Content Views WordPress plugin before version 4.5 suffers from an Authenticated SQL Injection vulnerability within one of its AJAX actions. This security flaw stems from an absolute absence of proper capability checks combined with inadequate sanitization of attacker-supplied parameters before their inclusion in database queries.\nThe primary impact of this vulnerability is unauthorized database access, potentially allowing malicious actors to extract sensitive information, manipulate database contents, or compromise the underlying database management system depending on database privileges. Any authenticated user, including low-privilege roles such as Subscribers, can exploit this security deficiency.\nExploitation requires network access to the target WordPress installation and a valid user account with minimal privileges, such as a Subscriber-level role. The risk implications are severe, as untrusted input flows directly into database execution contexts without proper validation or parameterization.\nOrganizations utilizing the Content Views WordPress plugin prior to version 4.5 face elevated risk exposure due to the accessibility of the vulnerable AJAX endpoint to authenticated users of any role tier. Remediation requires updating the plugin to version 4.5 or later where the missing authorization and input sanitization flaws are addressed.",
  "technicalDetails": "The root cause of this vulnerability lies in insecure AJAX action handling within the Content Views WordPress plugin prior to version 4.5. Specifically, the affected AJAX endpoint fails to execute requisite authorization routines, such as checking user capabilities via current_user_can() or verifying nonces for CSRF and authorization validation.\nFurthermore, the vulnerable component fails to properly sanitize, validate, or parameterize attacker-supplied data before incorporating it directly into a dynamic SQL query string. This improper neutralization of special elements leads directly to SQL injection.\nThe attack flow proceeds as follows: An authenticated user with low privileges, such as a Subscriber, initiates an HTTP request targeting the WordPress AJAX endpoint associated with the Content Views plugin. The request includes maliciously crafted parameters designed to alter the logic of the underlying SQL statement. Because the application omits capability checks, the server processes the request rather than rejecting it due to insufficient privileges.\nThe vulnerable code retrieves the user-supplied parameters and interpolates them directly into the database query without utilizing prepared statements or adequate input sanitization. The database management system executes the resulting malicious query, interpreting the attacker's input as executable SQL commands.\nThe authentication requirement is minimal, as any authenticated user, including low-privilege Subscriber accounts, can successfully invoke the vulnerable AJAX action. The attack vector is network-based, utilizing standard HTTP/HTTPS requests directed at the WordPress AJAX handler.\nPost-exploitation impact includes the potential retrieval of sensitive database contents—such as user credentials, options, and site data—as well as potential data modification or deletion, contingent upon database user permissions and query structure."
}