Authorization Flaw in Visualizer Plugin for WordPress
CVE-2026-86779

Currently unrated

Key Information:

Vendor

WordPress
Status
Visualizer
Vendor
CVE Published:
11 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-86779?

The Visualizer WordPress plugin prior to version 4.0.6 contains a significant authorization flaw that permits users with the Contributor role and above to delete any chart from the site without proper verification of ownership. The vulnerability arises from the plugin's single site-wide capability check, which fails to validate per-object ownership. As a result, users can maliciously remove charts created by other users, including those created by administrators, leading to potential data loss and disruption in services.

Affected Version(s)

Visualizer 0 < 4.0.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-86779 - Proof of Concept

References

https://wpscan.com/vulnerability/12a30aca-9b78-4ee8-9cf0-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yaswanth Reddy Sunkara
WPScan
.