The Visualizer – Tables & Charts Manager with Built‑in AI Generator plugin for WordPress contains a missing authorization check in all versions up to and including 4.0.3. When a user calls the REST endpoint /wp-json/visualizer/v1/action/{chart}/{type}/, the plugin does not verify that the caller has permission to export that chart. This permits unauthenticated attackers to obtain the contents of any visualizer chart – even those in draft, private, pending, future, or trash status – in CSV, Excel, or HTML formats. The weakness is a classic example of broken access control (CWE‑862).

Any WordPress site running Themeisle Visualizer – Tables & Charts Manager with Built‑in AI Generator plugin version 4.0.3 or earlier is affected. The vulnerability exists in all releases up to the stated version; upgrading to a later release that contains a fix removes the risk.

The vulnerability can be exploited by sending arbitrary HTTP GET requests to the affected REST endpoint, so the attack vector is network. No authentication is required; the attacker merely needs the chart identifier and the desired export format. The CVSS score of 7.5 indicates moderate‑high severity, and the KEV catalog does not list the vulnerability, implying no confirmed active exploitation. EPSS data is not available, so the likelihood of widespread exploitation is unknown, but the potential impact on data confidentiality is significant if an attacker can reach the site.