The Advanced Views plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) in its REST API implementation (register_rest_routes). Authenticated attackers with subscriber-level privileges can exploit this flaw to retrieve sensitive information authored by administrators, such as layout templates, CSS, JavaScript, and PHP variables associated with Layout or Post Selection posts. This exposure occurs in all plugin versions up to and including 3.9.1. No official remediation or patch information is currently available.

The vulnerability allows unauthorized disclosure of sensitive admin-authored content to authenticated users with low privileges (subscriber-level). This includes potentially sensitive template code and configuration data, which could aid further attacks or information gathering. There is no indication of impact on integrity or availability, only confidentiality is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for updates from the vendor. Avoid granting unnecessary authenticated access to untrusted users.