CVE-2026-8689
Deferred Deferred - Pending Action
Missing Authorization in Visualizer WordPress Plugin

Publication date: 2026-05-28

Last updated on: 2026-05-28

Assigner: Wordfence

Description
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.11.14. This is due to a missing capability check on the renderChartPages() and uploadData() functions, where the wp_ajax_visualizer-create-chart and wp_ajax_visualizer-edit-chart AJAX actions invoke renderChartPages() without any current_user_can() check, and wp_ajax_visualizer-upload-data invokes uploadData() which also lacks a capability check and validates its nonce without an action argument, making it trivially bypassable. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary chart posts and access or modify chart data belonging to other users, including administrators.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-28
Last Modified
2026-05-28
Generated
2026-05-28
AI Q&A
2026-05-28
EPSS Evaluated
N/A
NVD
CVE-2026-8689
EUVD
EUVD-2026-32746
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wp-visualizer visualizer to 3.11.14 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

The vulnerability exists in the Visualizer: Tables and Charts Manager plugin for WordPress, affecting all versions up to and including 3.11.14. It is caused by missing authorization checks in certain functions (renderChartPages() and uploadData()). Specifically, AJAX actions that invoke these functions do not properly verify user capabilities, allowing authenticated users with Subscriber-level access or higher to create arbitrary chart posts and access or modify chart data belonging to other users, including administrators.


How can this vulnerability impact me? :

This vulnerability allows attackers with low-level authenticated access (Subscriber-level) to create and manipulate chart posts and data that belong to other users, including administrators. This can lead to unauthorized modification of data, potential data integrity issues, and unauthorized access to sensitive chart information within the WordPress site.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart