Missing Authorization Vulnerability in Visualizer Plugin for WordPress

CVE-2026-8689

What is CVE-2026-8689?

The Visualizer: Tables and Charts Manager for WordPress plugin is susceptible to a missing authorization vulnerability across all versions up to and including 3.11.14. This issue arises from the absence of capability checks in the functions responsible for rendering chart pages and uploading data. Specifically, AJAX actions such as renderChartPages() and uploadData() can be exploited by authenticated attackers, including those with Subscriber-level access, allowing them to create arbitrary chart posts and manipulate chart data owned by other users, including administrators. This could lead to unauthorized information exposure and potential data integrity issues.

References