Executive brief
The Visualizer WordPress plugin contains an authorization flaw in its chart-deletion functionality that allows Contributor-level users to permanently delete charts created by other users, including administrators. This breaks the access control model, enabling low-privileged users to sabotage content and disrupt site operations by removing charts that may be critical to the website's functionality.
Technical details
The vulnerability is an authorization bypass (CWE-862) in the deleteChart AJAX action. The plugin performs only a site-wide capability check without verifying per-object ownership, allowing any user with the Contributor role or above to delete any chart on the site. The attack requires a Contributor account on the target site and exploits a generic nonce that is identical across all charts. An attacker can iterate through sequential chart IDs via the visualizer-delete-chart AJAX endpoint to delete all charts; the vulnerability has been fixed in version 4.0.6.
Affected products
- Visualizer Visualizer before 4.0.6
Timeline
- 2026-09-09: disclosed
- 2026-09-11: patched: Fixed in version 4.0.6
- 2026-09-11: advisory