Executive brief
A vulnerability in the Visualizer plugin for WordPress allows unauthorized individuals to access and download data from charts and tables. This includes sensitive information stored in private, draft, or deleted charts that were never intended for public viewing. An attacker can export this data in various formats like Excel or CSV without needing a password or account.
Technical details
The Visualizer plugin for WordPress (versions up to 4.0.3) contains an authorization bypass vulnerability due to missing capability checks on a custom-registered REST API route. While the standard WordPress REST endpoint for the 'visualizer' custom post type correctly enforces permissions, the plugin-specific route `/wp-json/visualizer/v1/action/{chart}/{type}/` does not. This allows unauthenticated remote attackers to bypass intended access controls and export chart data (including draft, private, pending, future, or trashed posts) as CSV, Excel, or HTML. The vulnerability is classified as CWE-862 (Missing Authorization).
Affected products
- ThemeIsle Visualizer – Tables & Charts Manager with Built-in AI Generator up to, and including, 4.0.3
Timeline
- 2026-07-01: disclosed
- 2026-07-01: advisory
References
- https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.1/classes/Visualizer/Module.php
- https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.1/classes/Visualizer/Module/Frontend.php
- https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.1/classes/Visualizer/Module/Frontend.php
- https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.3/classes/Visualizer/Module.php
- https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.3/classes/Visualizer/Module/Frontend.php
- https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.3/classes/Visualizer/Module/Frontend.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3591310%40visualizer&new=3591310%40visualizer&sfp_email=&sfph_mail=