PT-2026-44219 · Themeisle · The Visualizer: Tables/Charts Manager For Wordpress
CVE-2026-8689
·
Publicado
2026-05-28
·
Atualizado
2026-05-28
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.11.14. This is due to a missing capability check on the renderChartPages() and uploadData() functions, where the wp ajax visualizer-create-chart and wp ajax visualizer-edit-chart AJAX actions invoke renderChartPages() without any current user can() check, and wp ajax visualizer-upload-data invokes uploadData() which also lacks a capability check and validates its nonce without an action argument, making it trivially bypassable. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary chart posts and access or modify chart data belonging to other users, including administrators.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
The Visualizer: Tables/Charts Manager For Wordpress