WordPress Plugin Vulnerabilities

Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR

Description

The plugin does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.

Proof of Concept

Affects Plugins

Plugin icon
visualizer
Fixed in 4.0.6

References

CVE
CVE-2026-86782

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.5 (medium)

Miscellaneous

Original Researcher
Artus KG
Submitter
Artus KG
Submitter twitter
artuskg
Verified
Yes
WPVDB ID
ad9909b8-c302-4cb5-bbe7-bff89c64b6ce

Timeline

Publicly Published
2026-09-09 (about 2 days ago)
Added
2026-09-09 (about 1 day ago)
Last Updated
2026-09-09 (about 1 day ago)

Other

Published
Title
Published
2026-08-31
Title
Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API
Published
2026-01-01
Title
Cocco <= 1.5.1 - Authenticated (Subscriber+) Authenticated Insecure Direct Object Reference
Published
2026-05-20
Title
Broadstreet < 1.53.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta
Published
2026-08-27
Title
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website < 2.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-05-13
Title
MW WP Form < 5.1.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter