EUVD-2026-59919
GHSA-v7fh-395c-948j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network endpoint accessible with Contributor session (PR:L); no complexity or interaction required; confidentiality-only impact as no write or availability path exists.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own interface denies them, and to retrieve every chart's configuration in a single request. The disclosed configuration can include the credentials of a remote data source a chart reads from.
AnalysisAI
Insufficient authorization in the Visualizer WordPress plugin before 4.0.7 permits any authenticated Contributor-level user to retrieve the full configuration of every chart on the site through a single API request, bypassing the plugin's own UI-level access controls. The exposed configuration data may include credentials for remote data sources - such as database connection strings or API keys - that chart owners have configured. A publicly available proof-of-concept is referenced by WPScan; no active exploitation has been confirmed by CISA KEV, though the low barrier to exploitation makes patching urgent for any site with untrusted contributor accounts.
Technical ContextAI
The Visualizer plugin (CPE: cpe:2.3:a:unknown:visualizer:*:*:*:*:wordpress:*:*:*) is a WordPress charting and data-visualization tool that supports reading from remote data sources, requiring stored credentials. The root cause is CWE-863 (Incorrect Authorization): the plugin enforces access restrictions at the presentation layer (its admin UI) but fails to enforce equivalent checks on the underlying data-retrieval endpoint, which returns chart configurations including stored credentials. This is a classic UI-layer vs. API-layer authorization gap - a common pattern in WordPress plugins where AJAX or REST handlers are registered without capability checks that mirror what the front-end restricts. The vulnerability is network-reachable and requires only a valid low-privilege WordPress session (Contributor role), reflecting the CVSS AV:N/PR:L metrics. The scope is unchanged (S:U), meaning the blast radius is confined to the WordPress application context, but the confidentiality impact is rated high because of the potential for credential exfiltration.
RemediationAI
The primary fix is to upgrade the Visualizer WordPress plugin to version 4.0.7 or later, which corrects the authorization logic on the chart configuration endpoint. After upgrading, administrators should immediately audit whether any remote data source credentials stored in chart configurations were accessible to Contributor-level users prior to patching - if so, rotate those credentials (database passwords, API keys, etc.) as a precaution, since the configuration data could have been retrieved without leaving obvious traces. If immediate patching is not possible, a compensating control is to audit and temporarily remove the Contributor role from any untrusted user accounts, or disable charts that pull from credentialed remote data sources until the patch is applied. Restricting WordPress contributor registration to vetted users also limits the attack surface. The WPScan advisory at https://wpscan.com/vulnerability/61a1577e-077f-4a00-96b4-860eda48e03b/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-19726 should be referenced for confirmation of the fix version.
More in Visualizer
View allA blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-d
Server-Side Request Forgery in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-level u
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute ar
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated user holding
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrust
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualiz
SQL injection in the Visualizer WordPress plugin (versions 4.0.6 and earlier) allows an authenticated user holding only
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Visualiz
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-l
Stored XSS in the Themeisle Visualizer WordPress plugin (all versions before 4.0.0) allows an authenticated low-privileg
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Missing authorization on three AJAX handlers in the Visualizer: Tables and Charts Manager plugin for WordPress (by Theme
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today