Authorization Bypass in Visualizer – Tables & Charts Manager Plugin for WordPress

CVE-2026-13468

What is CVE-2026-13468?

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress contains a vulnerability that allows unauthorized users to bypass standard authorization checks. Versions up to 4.0.3 expose a REST endpoint that does not verify user permissions properly. This flaw permits unauthenticated attackers to access and export sensitive visualizer chart contents, regardless of their status (draft, private, pending, future, or trash). Unlike WordPress’s protected endpoints, which enforce capability checks, this vulnerability circumvents such protections, posing a significant risk to the data integrity and security of affected WordPress sites.

References