CVE-2026-15361 is a SQL injection vulnerability in the Content Views WordPress plugin prior to version 4.5. The vulnerability occurs due to the lack of capability checks on an AJAX action and improper sanitization of user input before it is incorporated into SQL queries. This enables authenticated users with low privileges to perform SQL injection attacks, potentially compromising the confidentiality and integrity of the database. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity, with network attack vector, low attack complexity, and no user interaction required.

An attacker with any authenticated user role, including Subscribers, can exploit this vulnerability to perform SQL injection attacks. This can lead to unauthorized disclosure or modification of sensitive data within the database. The vulnerability does not impact availability but has high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user roles to trusted users only and monitor for suspicious activity related to the plugin's AJAX actions. Avoid granting unnecessary privileges to low-level users.