Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint

Summary

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site — including charts in draft, private, pending, future, or trash status — as CSV, Excel, or HTML via the /wp-json/visualizer/v1/action/{chart}/{type}/ REST endpoint. This bypass is particularly impactful because the standard WordPress REST endpoint for the non-public 'visualizer' custom post type correctly enforces capability checks and returns HTTP 401 to unauthenticated callers, whereas this plugin-registered route circumvents that protection entirely.

Timeline

1. Jul 1, 2026, 3:43 AM UTCCVE published
2. Jul 1, 2026, 10:27 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Jul 1, 2026, 10:32 AM UTCRecord last updated

Affected versions

• themeisle Visualizer – Tables & Charts Manager with Built-in AI Generator

  through 4.0.3

References 8