# CVE-2026-86779: Visualizer WordPress plugin authorization bypass in chart deletion

Source: https://junglewise.ai/threats/cve-2026-86779-visualizer-wordpress-plugin-authorization-bypass-in-chart  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86779 · Severity: low · CVSS 2.7 · Published 2026-09-11

The Visualizer WordPress plugin contains an authorization flaw in its chart-deletion functionality that allows Contributor-level users to permanently delete charts created by other users, including administrators. This breaks the access control model, enabling low-privileged users to sabotage content and disrupt site operations by removing charts that may be critical to the website's functionality.

## Quick answers

**Is CVE-2026-86779 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86779 being exploited in the wild.

**How severe is CVE-2026-86779?** Low severity, with a CVSS score of 2.7, published 11 September 2026.

**Which products and versions are affected?** Visualizer Visualizer before 4.0.6.

**Is there a fix for CVE-2026-86779?** A patch was published on 2026-09-11: Fixed in version 4.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86779 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86779?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (CWE-862) in the deleteChart AJAX action. The plugin performs only a site-wide capability check without verifying per-object ownership, allowing any user with the Contributor role or above to delete any chart on the site. The attack requires a Contributor account on the target site and exploits a generic nonce that is identical across all charts. An attacker can iterate through sequential chart IDs via the visualizer-delete-chart AJAX endpoint to delete all charts; the vulnerability has been fixed in version 4.0.6.

## Affected products

- Visualizer Visualizer before 4.0.6

## Timeline

- 2026-09-09: disclosed
- 2026-09-11: patched: Fixed in version 4.0.6
- 2026-09-11: advisory

## References

- [https://wpscan.com/vulnerability/12a30aca-9b78-4ee8-9cf0-29e579ea5a0b/](https://wpscan.com/vulnerability/12a30aca-9b78-4ee8-9cf0-29e579ea5a0b/)