A missing capability check in the renderChartPages() and uploadData() functions allows any logged‑in user who has Subscriber-level permissions or higher to perform privileged chart operations. An attacker can create new chart posts, access chart data belonging to other users, or modify existing chart information without authorization. This leads to unauthorized disclosure or tampering of chart content within the WordPress site, potentially undermining data integrity and confidentiality. The weakness is an example of missing authorization (CWE‑862).

The vulnerability exists in the Visualizer: Tables and Charts Manager for WordPress plugin for all releases up to and including version 3.11.14. The plugin is maintained by ThemeIsle. Any WordPress site running a vulnerable version of this plugin is affected.

The CVSS score of 4.3 indicates a medium severity rating. The EPSS score is not available, so the current exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that the attacker be authenticated with at least Subscriber role, which is a relatively common scenario. The likely attack vector is via authenticated AJAX requests to the wp_ajax_visualizer‑create‑chart, wp_ajax_visualizer‑edit‑chart, and wp_ajax_visualizer‑upload‑data endpoints, where the missing capability checks allow the attacker to execute the vulnerable functions.