What is the CVSS score of EUVD-2026-40892?

EUVD-2026-40892 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of WordPress Visualizer Plugin are affected by EUVD-2026-40892?

Themeisle Visualizer plugin versions 4.0.3 and below contain an authorization bypass allowing unauthenticated internet users to access and export sensitive chart data-including unreleased,…

How to fix or mitigate EUVD-2026-40892?

Within 24 hours, identify all WordPress sites using Themeisle Visualizer plugin version 4.0.3 or earlier and immediately deactivate and remove the plugin, as it presents unpatched data exposure with no vendor remediation available. Within 7 days, conduct a data impact assessment to determine what sensitive information (customer data, business intelligence, financial metrics) may have been accessible through chart exports, and implement a temporary Web Application Firewall rule blocking requests to the vulnerable `/wp-json/visualizer/v1/action/*/` endpoint as a defensive measure. Within 30 days, migrate to an alternative charting solution with documented security practices, and establish a monitoring process for Themeisle security advisories so you can evaluate re-enabling the plugin only if and when a verified patch is released.

WordPress Visualizer Plugin EUVD-2026-40892

| CVE-2026-13468 HIGH

Missing Authorization (CWE-862)

2026-07-01 Wordfence

GHSA-m84g-2mgp-69wx

WordPress Authentication Bypass Wordpress Plugin Visualizer Tables Charts Manager With Built In Ai Generator

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network access with no interaction required; impact is confidentiality-only chart data disclosure; provided NVD vector is accurate and independently validated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 05:24 vuln.today

CVE Published

Jul 01, 2026 - 03:43 nvd

HIGH 7.5

DescriptionCVE.org

The Visualizer - Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site - including charts in draft, private, pending, future, or trash status - as CSV, Excel, or HTML via the /wp-json/visualizer/v1/action/{chart}/{type}/ REST endpoint. This bypass is particularly impactful because the standard WordPress REST endpoint for the non-public 'visualizer' custom post type correctly enforces capability checks and returns HTTP 401 to unauthenticated callers, whereas this plugin-registered route circumvents that protection entirely.

Articles & Coverage 1

News 16 New WordPress Vulnerabilities - 2 Critical, 14 High, 4 With POC Jul 02, 2026

AnalysisAI

Authorization bypass in the Themeisle Visualizer - Tables & Charts Manager plugin (all versions ≤ 4.0.3) exposes a plugin-registered REST endpoint /wp-json/visualizer/v1/action/{chart}/{type}/ that lacks the capability checks WordPress enforces on the standard visualizer custom post type REST routes. Unauthenticated remote attackers can enumerate and export the full contents of any chart on the site-including charts in draft, private, pending, future, or trash post status-as CSV, Excel, or HTML without any credentials. No public exploit code has been confirmed and CISA KEV does not list this CVE, though SSVC rates it Automatable:yes, making scripted mass-scanning across WordPress installations practical.

Technical ContextAI

The affected product is the Themeisle Visualizer plugin (CPE: cpe:2.3:a:themeisle:visualizer_-_tables_&_charts_manager_with_built-in_ai_generator:*:*:*:*:*:*:*:*), which registers a custom REST API route in its Frontend.php module (L155, L219) and Module.php (L182). CWE-862 (Missing Authorization) describes the root cause precisely: the plugin-registered route omits the permission_callback that WordPress requires to gate access to non-public post types. The standard WordPress REST endpoint for the visualizer CPT correctly returns HTTP 401 to unauthenticated callers via built-in capability enforcement, but this plugin-added route circumvents that protection entirely. The source code for both versions 4.0.1 and 4.0.3 at plugins.trac.wordpress.org confirms the vulnerable logic; a fix is present in upstream changeset 3591310.

RemediationAI

Update the Visualizer plugin to the version released after 4.0.3 - the upstream fix is available as changeset 3591310 at plugins.trac.wordpress.org, and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/45dbcc5e-2746-4a55-a1d1-a7c67fa2950e should be monitored for the confirmed patched release version. As a compensating control prior to patching, block unauthenticated access to the /wp-json/visualizer/v1/ path via a WAF rule or web server access control (nginx location block or Apache <Location> directive); trade-off: this may break legitimate front-end chart rendering for anonymous visitors if the same route serves public chart data. If the plugin is not actively required, deactivating or removing it entirely is the most complete risk elimination.