The Visualizer WordPress plugin before version 4.0.7 fails to enforce proper authorization for accessing chart configurations. Users with the Contributor role or higher can read the full configuration of any chart, including credentials for remote data sources that the plugin’s own interface normally protects. This vulnerability allows an authorized user to acquire sensitive configuration data, potentially exposing authentication details for external services. The disclosed information can compromise the confidentiality of the site’s connected data sources and the broader network if those credentials are exploitable.

The flaw affects all installations of the Visualizer plugin for WordPress running any version earlier than 4.0.7. Sites that rely on older releases are at risk regardless of other security controls, as the plugin itself provides the privileged access.

The risk is moderate as indicated by a CVSS score of 6.5, and it depends on how many users hold Contributor or higher roles. An attacker can retrieve all chart configurations in a single request, potentially exposing remote data source credentials. The vulnerability is not listed in the CISA KEV catalog, but the EPSS score of <1% indicates that exploitation is considered very low in likelihood. Based on the description, the attack vector is inferred to be internal: it requires a user account with Contributor‑level permissions on the WordPress site.