Description

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own interface denies them, and to retrieve every chart's configuration in a single request. The disclosed configuration can include the credentials of a remote data source a chart reads from.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-16T06:16:52.580Z",
  "pubdate": "2026-08-16T06:16:52.580Z",
  "executiveSummary": "An authorization vulnerability exists in the Visualizer WordPress plugin prior to version 4.0.7, allowing unauthorized retrieval of sensitive chart configurations. The flaw specifically impacts the access control mechanisms governing chart configuration endpoints within the plugin.\nUsers authenticated with the Contributor role or higher can exploit this security deficiency to bypass interface restrictions and read the full configuration of any chart present on the target site. This includes bypassing UI-level limitations that would normally deny access to specific charts.\nThe primary risk implication involves the potential disclosure of sensitive credentials. Chart configurations managed by the Visualizer plugin frequently store authentication parameters and credentials required to access remote data sources.\nAn attacker possessing low-privileged access, specifically a Contributor account, can leverage this vulnerability to aggregate and retrieve every chart's configuration in a single request, significantly streamlining the reconnaissance and data exfiltration phase.\nMitigation requires updating the Visualizer WordPress plugin to version 4.0.7 or later to ensure proper authorization checks are enforced on chart configuration retrieval requests.",
  "technicalDetails": "The vulnerability stems from insufficient server-side authorization validation within the Visualizer WordPress plugin prior to version 4.0.7. Specifically, the request handling logic fails to adequately verify whether a requesting user possesses the necessary administrative or editing privileges required to access specific chart configurations.\nThe vulnerable component involves the REST API endpoints or AJAX handlers responsible for serving chart settings and data source properties. While the administrative user interface may restrict lower-privileged users from viewing certain charts, the underlying backend endpoints lack proper capability checks.\nAuthentication and privilege requirements are minimal. An adversary must authenticate with at least the Contributor role on the target WordPress site. No higher-privileged access, such as Administrator or Editor, is required to trigger the flaw.\nThe attack flow proceeds as follows: First, an authenticated user with the Contributor role initiates a crafted HTTP request targeting the vulnerable chart configuration retrieval endpoint. Second, due to the absence of rigorous authorization enforcement, the backend processes the request without validating whether the user is authorized to access the specific chart ID or bulk-retrieve configurations. Third, the application compiles and returns the complete configuration data sets for the requested charts in a single server response.\nNetwork exposure is inherent to web applications running WordPress, where HTTP/HTTPS requests reach the plugin endpoints. The payload behavior involves issuing requests designed to query individual or aggregated chart configurations, effectively bypassing the interface restrictions enforced by the Visualizer plugin.\nThe post-exploitation impact includes the exposure of sensitive operational data. Because charts created via the Visualizer WordPress plugin often connect to external databases or remote APIs, their configurations frequently contain embedded credentials, API keys, or connection strings. Exfiltrating these credentials enables lateral movement, unauthorized access to remote data sources, and potential compromise of external enterprise assets connected to the WordPress instance."
}