The Visualizer WordPress plugin before version 4.0.7 fails to enforce proper authorization for accessing chart configurations. Users with the Contributor role or higher can read the full configuration of any chart, including credentials for remote data sources that the plugin’s own interface normally protects. This vulnerability allows an authorized user to acquire sensitive configuration data, potentially exposing authentication details for external services. The disclosed information can compromise the confidentiality of the site’s connected data sources and the broader network if those credentials are exploitable.

The flaw affects all installations of the Visualizer plugin for WordPress running any version earlier than 4.0.7. Sites that rely on older releases are at risk regardless of other security controls, as the plugin itself provides the privileged access.

The risk is modest to high depending on the breadth of users assigned Contributor or higher roles. An attacker could gather all chart configurations in a single request, immediately exposing credentials for remote data sources. No public exploits are documented, and the vulnerability is not listed in the CISA KEV catalog; however, the EPSS score is unavailable, so exploitation likelihood cannot be precisely quantified. The attack vector is internal: it requires a user account with Contributor‑level permissions on the WordPress site.