Description

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-11T07:16:47.643Z",
  "pubdate": "2026-09-11T07:16:47.643Z",
  "executiveSummary": "The Visualizer WordPress plugin before version 4.0.6 contains an improper authorization vulnerability within its chart-building functionality. This flaw allows authenticated users with the Contributor role or higher to perform unauthorized actions on posts and pages, including modifying, renaming, or overwriting content belonging to other users. The vulnerability stems from insufficient access control checks during the execution of chart-management routines. If exploited, an attacker could manipulate the site's content structure, potentially leading to unauthorized data modification, defacement, or the exposure of sensitive information contained within private drafts. The attack requires the attacker to possess an account with at least Contributor-level privileges, which is a common threat vector in multi-user WordPress environments. This flaw poses a significant integrity and availability risk to the affected WordPress installation.",
  "technicalDetails": "The vulnerability resides in the authorization logic governing the Visualizer plugin's chart-building and management actions. Specifically, the plugin fails to implement granular capability checks (such as 'edit_post' or 'edit_others_posts') before executing administrative or privileged content modification functions. When a request is made to the plugin's chart-building endpoint, the application does not verify if the current user owns the target resource or possesses the necessary WordPress capabilities to modify content belonging to other users or administrators.\nThe root cause is an insecure implementation of access control checks within the plugin's backend request handlers. The software assumes that any authenticated user with a 'Contributor' role or above is authorized to interact with its chart-related post-manipulation functions. Because these functions do not validate the user's authority against the specific target post ID, an attacker can manipulate parameters in the request to target posts or pages outside their authorization scope.\nThe exploitation flow begins when an authenticated attacker, holding at least Contributor privileges, crafts an HTTP request targeting the plugin's specific chart-building action. By manipulating the request parameters—such as the target post/page ID—the attacker can instruct the plugin to perform actions like renaming or overwriting content. Because the application logic lacks a cross-reference check between the current user's ID and the author ID of the target resource, the server proceeds to execute the write operation.\nThis vulnerability is particularly impactful because it allows for the modification of private drafts and protected content, which are typically restricted from Contributor-level access in the WordPress core. By overwriting existing content, an attacker can perform unauthorized site defacement or inject malicious strings. The vulnerability exists in all versions of the Visualizer plugin prior to 4.0.6. Successful exploitation is limited to authenticated users; however, the lack of server-side validation makes the impact severe in any environment where multiple users are allowed to contribute content to the site."
}