Executive brief
The Visualizer plugin for WordPress, which is used to create and manage interactive charts and tables, contains a security flaw that allows low-level users to perform administrative actions. An attacker with a basic subscriber account could create unauthorized chart posts or modify data belonging to other users, including site administrators. This could lead to unauthorized content changes and the corruption of existing data visualizations on the website.
Technical details
The vulnerability is classified as Missing Authorization (CWE-862) within the renderChartPages() and uploadData() functions. The wp_ajax_visualizer-create-chart and wp_ajax_visualizer-edit-chart AJAX actions fail to implement current_user_can() checks, while the wp_ajax_visualizer-upload-data action lacks both capability checks and robust nonce validation. An authenticated attacker with Subscriber-level privileges can exploit these endpoints to create arbitrary chart posts or modify chart data belonging to other users. The issue affects all versions up to and including 3.11.14; a fix is available in subsequent versions.
Affected products
- ThemeIsle Visualizer: Tables and Charts Manager for WordPress up to, and including, 3.11.14
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
References
- https://plugins.trac.wordpress.org/browser/visualizer/tags/3.11.14/classes/Visualizer/Module/Chart.php
- https://plugins.trac.wordpress.org/browser/visualizer/tags/3.11.14/classes/Visualizer/Module/Chart.php
- https://plugins.trac.wordpress.org/browser/visualizer/tags/3.11.14/classes/Visualizer/Module/Chart.php
- https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.1/classes/Visualizer/Module/Chart.php
- https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.1/classes/Visualizer/Module/Chart.php
- https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.1/classes/Visualizer/Module/Chart.php
- https://plugins.trac.wordpress.org/changeset/3474710