Quick answers
- Is CVE-2026-86779 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86779 being exploited in the wild.
- How severe is CVE-2026-86779?
- Low severity, with a CVSS score of 2.7, published 11 September 2026.
- Which products and versions are affected?
- Visualizer Visualizer before 4.0.6.
- Is there a fix for CVE-2026-86779?
- A patch was published on 2026-09-11: Fixed in version 4.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86779 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-86779?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authorization bypass (CWE-862) in the deleteChart AJAX action. The plugin performs only a site-wide capability check without verifying per-object ownership, allowing any user with the Contributor role or above to delete any chart on the site. The attack requires a Contributor account on the target site and exploits a generic nonce that is identical across all charts. An attacker can iterate through sequential chart IDs via the visualizer-delete-chart AJAX endpoint to delete all charts; the vulnerability has been fixed in version 4.0.6.
Affected products
- Visualizer Visualizer before 4.0.6
Timeline
- 2026-09-09: disclosed
- 2026-09-11: patched: Fixed in version 4.0.6
- 2026-09-11: advisory