What is the CVSS score of CVE-2026-8689?

CVE-2026-8689 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Visualizer WordPress Plugin CVE-2026-8689

EUVD-2026-32746 MEDIUM

Missing Authorization (CWE-862)

2026-05-28 Wordfence

GHSA-m527-mm28-jvgm

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 09:22 vuln.today

CVE Published

May 28, 2026 - 07:43 nvd

MEDIUM 4.3

DescriptionCVE.org

The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.11.14. This is due to a missing capability check on the renderChartPages() and uploadData() functions, where the wp_ajax_visualizer-create-chart and wp_ajax_visualizer-edit-chart AJAX actions invoke renderChartPages() without any current_user_can() check, and wp_ajax_visualizer-upload-data invokes uploadData() which also lacks a capability check and validates its nonce without an action argument, making it trivially bypassable. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary chart posts and access or modify chart data belonging to other users, including administrators.

AnalysisAI

Missing authorization on three AJAX handlers in the Visualizer: Tables and Charts Manager plugin for WordPress (by Themeisle) allows authenticated attackers with Subscriber-level access to create arbitrary chart posts and read or overwrite chart data owned by any site user, including administrators. The wp_ajax_visualizer-create-chart, wp_ajax_visualizer-edit-chart, and wp_ajax_visualizer-upload-data actions invoke renderChartPages() and uploadData() without any current_user_can() capability check; the nonce validation in uploadData() is further trivialized by the absence of an action argument, making it bypassable with any valid WordPress nonce. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 4.0.1.

Technical ContextAI

The root cause is CWE-862 (Missing Authorization) in the WordPress plugin Visualizer by Themeisle (CPE: cpe:2.3:a:themeisle:visualizer). WordPress's AJAX subsystem routes logged-in requests to wp_ajax_{action} hooks; by convention, handlers must call current_user_can() to verify role-based permissions before operating on content. In Visualizer 3.11.14 and earlier, the renderChartPages() function registered for both visualizer-create-chart and visualizer-edit-chart actions (Chart.php lines 531 and 1221) omits this check entirely. The uploadData() function (Chart.php line 56) for the visualizer-upload-data action similarly lacks a capability check, and its nonce verification uses wp_verify_nonce() without supplying the second 'action' argument - meaning any valid WordPress nonce for any context satisfies the check - effectively neutralizing that security control. The fix, confirmed in changeset 3474710 and visible in the 4.0.1 source tree, adds proper capability checks to all three handlers.

RemediationAI

Upgrade the Visualizer plugin to version 4.0.1 or later; the fix is confirmed in WordPress plugin repository changeset 3474710 (https://plugins.trac.wordpress.org/changeset/3474710), which introduces proper current_user_can() capability checks on all three affected AJAX handlers. Full advisory details are documented by Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/d18e9696-0f96-4478-9871-a93ac2976c11. If immediate upgrade is not feasible, disable open user registration in WordPress (Settings > General > uncheck 'Anyone can register') to eliminate the ability for unknown parties to obtain a Subscriber account; note this does not protect against attackers who already hold a low-privilege account. A WAF rule blocking POST requests to wp-admin/admin-ajax.php where the 'action' parameter equals visualizer-create-chart, visualizer-edit-chart, or visualizer-upload-data from non-admin sessions provides a compensating control, but may break legitimate Subscriber-facing chart creation features. Neither workaround substitutes for patching.