CVE-2026-86782

Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR

View on CVE.org
Published Sep 11, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Description
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.

Analysis

AI-generated

Technical impact

The Visualizer plugin before version 4.0.6 does not properly authorise access to its chart‑building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own flaw permits the attacker to publish new content, effectively enabling defacement, data leakage, and site disruption.

Affected Systems

Any WordPress site running the Visualizer plugin version prior to 4.0.6 is vulnerable. The flaw applies to all accounts with a Contributor role or higher; there is no mention of additional WordPress core version dependencies.

Risk and Exploitability

The vulnerability scores 5.5 on CVSS, indicating medium severity. The vulnerability is an Insecure Direct Object requires only a Contributor-level account. No EPSS value is available and the issue is not listed in the CISA KEV catalog; however the scope of impact and the ease of execution have wide access.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Visualizer plugin to version 4.0.6 or later.
  • If many users hold the Contributor role, consider tightening role permissions or limiting the scope of what Contributors can edit to reduce potential impact.
  • Limit contributor access by disabling the‑based access control plugin or by promoting Contributors to a lower role such as Subscriber where necessary.

Generated by OpenCVE AI on September 11, 2026 at 14:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions visualizer
Vendors & Products Wordpress-extensions
Wordpress-extensions visualizer
Type Values Removed Values Added
Weaknesses CWE-284
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-284
CWE-639
Type Values Removed Values Added
Description The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.
Title Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR
References
Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Sep 11, 2026, 10:00 AM
Reserved
Sep 8, 2026, 11:45 AM

View source JSON

Updated
Sep 11, 2026, 9:58 AM

JSON

Status
Deferred
Published
Sep 11, 2026, 7:16 AM
Modified
Sep 11, 2026, 5:35 PM

View source JSON

No data.

Updated
Nov 13, 2026, 12:40 PM

JSON