Description
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.
Published: 2026-09-11
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary modification of posts and pages by users with Contributor role or higher, allowing defacement and unauthorized data changes
Action: Patch immediately
AI Analysis

Impact

The Visualizer plugin before version 4.0.6 does not properly authorise access to its chart‑building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own flaw permits the attacker to publish new content, effectively enabling defacement, data leakage, and site disruption.

Affected Systems

Any WordPress site running the Visualizer plugin version prior to 4.0.6 is vulnerable. The flaw applies to all accounts with a Contributor role or higher; there is no mention of additional WordPress core version dependencies.

Risk and Exploitability

The vulnerability scores 5.5 on CVSS, indicating medium severity. The vulnerability is an Insecure Direct Object requires only a Contributor-level account. No EPSS value is available and the issue is not listed in the CISA KEV catalog; however the scope of impact and the ease of execution have wide access.

Generated by OpenCVE AI on September 11, 2026 at 14:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Visualizer plugin to version 4.0.6 or later.
  • If many users hold the Contributor role, consider tightening role permissions or limiting the scope of what Contributors can edit to reduce potential impact.
  • Limit contributor access by disabling the‑based access control plugin or by promoting Contributors to a lower role such as Subscriber where necessary.

Generated by OpenCVE AI on September 11, 2026 at 14:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Fri, 11 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 11 Sep 2026 09:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-639

Fri, 11 Sep 2026 06:30:00 +0000

Type Values Removed Values Added
Description The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.
Title Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-09-11T10:00:38.078Z

Reserved: 2026-09-08T11:45:46.479Z

Link: CVE-2026-86782

cve-icon Vulnrichment

Updated: 2026-09-11T09:58:46.987Z

cve-icon NVD

Status : Deferred

Published: 2026-09-11T07:16:47.643

Modified: 2026-09-11T17:35:21.440

Link: CVE-2026-86782

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T14:15:18Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key