Description

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-09-11T07:16:47.343Z",
  "pubdate": "2026-09-11T07:16:47.343Z",
  "executiveSummary": "The Visualizer WordPress plugin prior to version 4.0.6 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability resulting from flawed authorization logic during chart-deletion operations.\nThe vulnerability originates from a failure to perform per-object ownership verification, relying instead on a broad, site-wide capability check.\nThis flaw allows authenticated users assigned the Contributor role or higher to delete arbitrary charts stored within the WordPress database, regardless of the original creator's identity or administrative status.\nThe risk implication is significant for site integrity, as unauthorized users can execute destructive actions, leading to the permanent loss of data, potential service disruption, and unauthorized modification of published site content.\nExploitation requires the attacker to hold at least Contributor-level credentials. No specialized social engineering or elevated administrative privileges are necessary, as the vulnerability can be triggered through standard authenticated requests directed at the chart management functionality.\nThe vulnerability impacts all instances of the Visualizer plugin running versions earlier than 4.0.6, necessitating an immediate update to remediate the broken access control mechanism.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the authorization process within the plugin's chart deletion handler. When an object-deletion request is initiated, the application logic executes a capability check that validates the user's general WordPress permission level (e.g., 'edit_posts' or similar capabilities associated with the Contributor role) but fails to validate the ownership relationship between the requesting user and the specific chart ID targeted for deletion.\nIn a secure implementation, the system should verify that the current user ID matches the 'author' field of the database record associated with the specific chart object. By omitting this check, the application performs an insecure access control operation where the server-side logic trusts the user-supplied chart identifier without verifying that the user has the authority to act upon that specific resource.\nThe attack flow proceeds as follows: 1) An attacker authenticates as a user with at least Contributor privileges. 2) The attacker identifies a target chart ID, which is often discoverable via the WordPress REST API or predictable URL patterns within the dashboard. 3) The attacker crafts a deletion request, typically containing an action parameter and the target chart ID, directed at the plugin’s designated endpoint. 4) The plugin validates that the user is authenticated and possesses basic site-wide permissions. 5) Finding the capability check satisfied, the plugin proceeds to execute the deletion query against the database, removing the chart resource entirely.\nBecause the server does not enforce contextual authorization, the attacker can iterate through sequential or enumerated IDs to perform mass deletion of content. This behavior persists as long as the user's role satisfies the site-wide check, circumventing the intended security model where users should only interact with their own data.\nThe vulnerability is localized to the server-side components responsible for managing Visualizer plugin data. Impact is strictly limited to unauthorized deletion, though the permanent nature of the database removal renders this a high-impact integrity issue. The lack of per-object ownership verification represents a failure in implementing the principle of least privilege, allowing users to exceed their defined administrative boundaries and negatively impact other users' content."
}