Authorization Flaw in Visualizer Plugin Affects WordPress Users
CVE-2026-19726
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 16 August 2026
Badges
What is CVE-2026-19726?
The Visualizer Plugin for WordPress, prior to version 4.0.7, contains an authorization flaw that allows users with Contributor privileges and higher to access sensitive chart configurations. This vulnerability enables these users to read full configurations of charts, including those that should be restricted, and retrieve multiple chart configurations in a single request. The disclosed information may expose critical credentials associated with remote data sources utilized by the charts, which poses significant security risks for WordPress sites utilizing this plugin.
Affected Version(s)
Visualizer 0 < 4.0.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.