What is the CVSS score of CVE-2026-65526?

CVE-2026-65526 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Visualizer are affected by CVE-2026-65526?

The Visualizer WordPress plugin (versions 4.0.6 and earlier) contains a SQL injection vulnerability that permits contributors-a commonly-granted, low-trust role-to extract sensitive data including…

How to fix or mitigate CVE-2026-65526?

Within 24 hours, audit your WordPress installation to confirm whether Visualizer plugin version 4.0.6 or earlier is installed and identify all users with Contributor role. Within 7 days, implement compensating controls: restrict Contributor role capabilities to prevent SQL-level database access using WordPress permission filters, enable database query logging with real-time alerts for SQL injection patterns, and audit recent contributor activity for unauthorized data access attempts. Within 30 days, monitor Patchstack and vendor security advisories for a patch release; if no patch emerges within reasonable timeframe, evaluate alternative visualization plugins or disable Visualizer on non-critical sites.

Visualizer CVE-2026-65526

EUVD-2026-48127 HIGH

SQL Injection (CWE-89)

2026-07-23 Patchstack

GHSA-jvhx-5xgq-jrmp

WordPress SQLi Visualizer Wordpress Plugin Themeisle

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Contributor authentication required so PR:L; SQLi yields high confidentiality (DB read) and limited integrity via writes, no availability impact, and no genuine cross-system scope change (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:28 vuln.today

CVE Published

Jul 23, 2026 - 11:19 cve.org

HIGH 8.5

DescriptionCVE.org

Contributor SQL Injection in Visualizer <= 4.0.6 versions.

AnalysisAI

SQL injection in the Visualizer WordPress plugin (versions 4.0.6 and earlier) allows an authenticated user holding only Contributor-level privileges to inject arbitrary SQL into backend database queries, enabling extraction of sensitive data such as user credentials and secrets. Reported by Patchstack and tracked under CWE-89, the flaw carries a CVSS 8.5 (scope-changed) rating; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The low privilege bar (Contributor is a common, low-trust role on multi-author sites) makes this a meaningful risk for any site that grants untrusted users content-contribution access.

Technical ContextAI

Visualizer is a themeisle-authored WordPress plugin used to build charts and tables from data sources, rendered inside posts/pages. The vulnerability is a classic CWE-89 SQL injection: user-controllable input reaching a database query is concatenated without adequate parameterization or sanitization (WordPress $wpdb->prepare() or equivalent escaping is missing or bypassable). Because the affected surface is reachable by the Contributor role, the injectable parameter is exposed through the plugin's chart/data-handling AJAX or admin endpoints available to authenticated low-privilege users. The affected component per CPE is cpe:2.3:a:themeisle:visualizer, all versions up to and including 4.0.6.

RemediationAI

Update the Visualizer plugin to the latest available release above 4.0.6 as published by themeisle; the input data does not include an exact fixed version number, so confirm the patched release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/visualizer/vulnerability/wordpress-visualizer-plugin-4-0-6-sql-injection-vulnerability) and the plugin's changelog before deploying. Until patched, reduce exposure by auditing and removing untrusted Contributor-level accounts, disabling open user registration (Settings → General → 'Anyone can register'), and restricting the Contributor role from the plugin's data/chart endpoints via a capability or WAF rule; a virtual patch through Patchstack or a WAF that filters SQL metacharacters on the affected parameters is a reasonable interim control. The trade-off of tightening Contributor access is disruption to legitimate guest-author or editorial workflows, so scope the restriction to the Visualizer endpoints where possible.