EUVD-2026-75968
GHSA-p8f8-hfx5-63r6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Contributor is a low-privilege WordPress role (PR:L not PR:H); permanent deletion of chart objects justifies A:L alongside I:L.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.
AnalysisAI
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-level user to permanently delete charts created by other users, including administrators, by exploiting a missing per-chart ownership check on deletion requests. The plugin validates only a site-wide capability (confirming the user can edit content generally) but never verifies whether the requesting user owns the specific chart being deleted - a classic BOLA/IDOR pattern under CWE-862. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress user account with at least the Contributor role on the target site - no higher privilege is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS score of 2.7 with PR:H (High privileges required) appears miscalibrated against the vulnerability description, which explicitly states Contributor-level access is sufficient. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Visualizer WordPress plugin to version 4.0.6 or later, which introduces per-object ownership verification on chart deletion requests - this is the only confirmed fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Visualizer
View allA blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-d
Server-Side Request Forgery in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-level u
Insufficient authorization in the Visualizer WordPress plugin before 4.0.7 permits any authenticated Contributor-level u
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute ar
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated user holding
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrust
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualiz
SQL injection in the Visualizer WordPress plugin (versions 4.0.6 and earlier) allows an authenticated user holding only
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Visualiz
Stored XSS in the Themeisle Visualizer WordPress plugin (all versions before 4.0.0) allows an authenticated low-privileg
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Missing authorization on three AJAX handlers in the Visualizer: Tables and Charts Manager plugin for WordPress (by Theme
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today