Executive brief
The Visualizer WordPress plugin is used to create charts and visualizations in WordPress sites. Before version 4.0.6, the plugin fails to properly check whether a user has permission to edit specific posts or pages, allowing contributors (low-privilege users) to modify, rename, or publish content owned by other users—including administrators' private drafts. This could allow an attacker to deface content, steal unpublished work, or inject malicious material into a site.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the plugin's chart-building AJAX actions (visualizer-ai-save, visualizer-ai-chart-nonce, and visualizer-ai-upload). The plugin registers its admin menu with only the edit_posts capability, allowing contributors to access the page, but does not verify that the user owns or has permission to edit the specific post/page identified by chart_id before processing modifications. An authenticated contributor can mint nonces and submit AJAX requests to rename, publish, or overwrite content they do not own. The attack requires knowing the target post/page's numeric ID but no additional authentication is needed beyond contributor access. The vulnerability is fixed in version 4.0.6.
Affected products
- Visualizer Visualizer before 4.0.6
Timeline
- 2026-09-09: disclosed
- 2026-09-09: patched: Fixed in version 4.0.6