# CVE-2026-86782: Visualizer WordPress plugin privilege escalation via IDOR

Source: https://junglewise.ai/threats/cve-2026-86782-visualizer-wordpress-plugin-privilege-escalation-via-idor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86782 · Severity: medium · CVSS 5.5 · Published 2026-09-11

The Visualizer WordPress plugin is used to create charts and visualizations in WordPress sites. Before version 4.0.6, the plugin fails to properly check whether a user has permission to edit specific posts or pages, allowing contributors (low-privilege users) to modify, rename, or publish content owned by other users—including administrators' private drafts. This could allow an attacker to deface content, steal unpublished work, or inject malicious material into a site.

## Quick answers

**Is CVE-2026-86782 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86782 being exploited in the wild.

**How severe is CVE-2026-86782?** Medium severity, with a CVSS score of 5.5, published 11 September 2026.

**Which products and versions are affected?** Visualizer Visualizer before 4.0.6.

**Is there a fix for CVE-2026-86782?** A patch was published on 2026-09-09: Fixed in version 4.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86782 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86782?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) in the plugin's chart-building AJAX actions (visualizer-ai-save, visualizer-ai-chart-nonce, and visualizer-ai-upload). The plugin registers its admin menu with only the edit_posts capability, allowing contributors to access the page, but does not verify that the user owns or has permission to edit the specific post/page identified by chart_id before processing modifications. An authenticated contributor can mint nonces and submit AJAX requests to rename, publish, or overwrite content they do not own. The attack requires knowing the target post/page's numeric ID but no additional authentication is needed beyond contributor access. The vulnerability is fixed in version 4.0.6.

## Affected products

- Visualizer Visualizer before 4.0.6

## Timeline

- 2026-09-09: disclosed
- 2026-09-09: patched: Fixed in version 4.0.6

## References

- [https://wpscan.com/vulnerability/ad9909b8-c302-4cb5-bbe7-bff89c64b6ce/](https://wpscan.com/vulnerability/ad9909b8-c302-4cb5-bbe7-bff89c64b6ce/)