Security Alert Summary
The Visualizer: Tables and Charts Manager for WordPress plugin is affected by a missing authorization vulnerability (CVE-2026-8689) in all versions up to and including 3.11.14. Authenticated users with Subscriber-level access and above can invoke AJAX actions that call plugin functions without proper capability checks or with a trivially bypassable nonce validation, allowing creation of chart posts and access or modification of chart data belonging to other users.
CVE Details
- CVE ID: CVE-2026-8689
- Affected plugin / component: Visualizer: Tables and Charts Manager for WordPress plugin
- Affected versions: All versions up to and including 3.11.14
- Published: May 28, 2026 at 9:16 AM
- Last modified: May 28, 2026 at 1:45 PM
- CVSS v3.1:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N— Base score 4.3 (MEDIUM) - Authentication / Privileges / User interaction:
- Authentication: requires an authenticated user (description notes Subscriber-level access and above)
- Privileges required (CVSS): LOW
- User interaction (CVSS): NONE
- Primary impact:
- Confidentiality: None (CVSS)
- Integrity: Low (CVSS) — ability to create or modify chart data
- Availability: None (CVSS)
- CWE: CWE-862 (Missing Authorization)
Technical Details
The vulnerability is a missing authorization check in the plugin code. Specifically, the renderChartPages() and uploadData() functions are invoked by AJAX actions without appropriate capability checks. The AJAX actions named in the code are wp_ajax_visualizer-create-chart, wp_ajax_visualizer-edit-chart, and wp_ajax_visualizer-upload-data.
The renderChartPages() function is called by the create and edit chart AJAX actions without a current_user_can() check, allowing authenticated users with low privileges to create chart posts. The uploadData() function lacks a capability check and validates a nonce without an action argument, making the nonce validation trivially bypassable. Together these issues allow authenticated users at Subscriber-level and above to create arbitrary chart posts and to access or modify chart data belonging to other users, including administrators, without intended authorization checks.
How This Could Impact Your Website
Imagine a site with several user roles: the site owner, an editor or two on staff, and an external contributor or contractor who has Subscriber-level access for limited tasks. An authenticated contractor or contributor could use the affected AJAX endpoints to create chart posts or upload and modify chart data tied to other users. That could expose internal chart content and potentially reveal user-associated metadata.
Practical consequences include exposure of internal user email addresses or other data stored with charts and an increased risk of targeted phishing or social engineering against staff or administrators who appear associated with chart items. If your workflows rely on chart posts as part of reporting or data sharing, those items could be created or altered by unauthorized low-privilege accounts.
If you
re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributor and Subscriber accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and plugin logs for unusual behavior related to chart creation or data uploads.
If you
like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/visualizer/tags/3.11.14/classes/Visualizer/Module/Chart.php#L1221
- https://plugins.trac.wordpress.org/browser/visualizer/tags/3.11.14/classes/Visualizer/Module/Chart.php#L531
- https://plugins.trac.wordpress.org/browser/visualizer/tags/3.11.14/classes/Visualizer/Module/Chart.php#L56
- https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.1/classes/Visualizer/Module/Chart.php#L1221
- https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.1/classes/Visualizer/Module/Chart.php#L531
- https://plugins.trac.wordpress.org/browser/visualizer/tags/4.0.1/classes/Visualizer/Module/Chart.php#L56
- https://plugins.trac.wordpress.org/changeset/3474710
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d18e9696-0f96-4478-9871-a93ac2976c11?source=cve
