Authorization Bypass in Visualizer WordPress Plugin

Executive Summary

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 4.0.3.

This vulnerability occurs because the plugin does not properly verify whether a user is authorized to perform certain actions.

As a result, unauthenticated attackers can access and export the contents of any visualizer chart on the site, including those in draft, private, pending, future, or trash status.

They can export these charts as CSV, Excel, or HTML files via a specific REST endpoint (/wp-json/visualizer/v1/action/{chart}/{type}/).

This bypass is significant because the standard WordPress REST endpoint for the non-public 'visualizer' custom post type correctly enforces capability checks and returns HTTP 401 to unauthenticated users, but this plugin route circumvents that protection entirely.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to access sensitive data contained in visualizer charts on your WordPress site.

Attackers can export chart data regardless of its visibility status, including private or draft charts, potentially exposing confidential or sensitive information.

Since the vulnerability does not require authentication, it increases the risk of data leakage without any user credentials.

The impact is rated with a CVSS base score of 7.5, indicating a high severity due to the ease of exploitation and the confidentiality impact.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the vulnerable Visualizer plugin is installed and its version is up to and including 4.0.3.

To detect exploitation attempts on your system, you can monitor HTTP requests to the REST endpoint /wp-json/visualizer/v1/action/{chart}/{type}/, which is used to access and export chart data without proper authorization.

A possible command to detect such requests in web server logs (e.g., Apache or Nginx) is to use grep:

• grep "/wp-json/visualizer/v1/action/" /var/log/apache2/access.log
• grep "/wp-json/visualizer/v1/action/" /var/log/nginx/access.log

Additionally, you can use network monitoring tools or intrusion detection systems to alert on HTTP requests targeting this specific REST endpoint.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the Visualizer – Tables & Charts Manager plugin to a version later than 4.0.3 where the authorization bypass issue is fixed.

If an update is not immediately possible, consider disabling the plugin temporarily to prevent unauthorized access to chart data.

Additionally, restrict access to the REST endpoint /wp-json/visualizer/v1/action/{chart}/{type}/ via web server rules or firewall to trusted users only.

Useful 0 Not Useful 0