Visualizer: Tables and Charts Manager for: Privilege escalation or authentication bypass

Visualizer: Tables and Charts Manager for is affected by privilege escalation or authentication bypass. Exploitation requires at least subscriber-level access. A successful request can grant permissions or access that the caller should not possess.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com

NVD score Pending NVD has not published its own CVSS assessment.

Component: Visualizer: Tables and Charts Manager for
Plugin slug: visualizer
Affected: See vendor advisory
Safe version: See mitigation notes
Published: May 16, 2024
Weakness: CWE-862 — Missing Authorization

This CVE was published May 16, 2024 and is one of 13 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Visualizer: Tables and Charts Manager for to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on the getQueryData() function in all versions up to, and including, 3.10.15. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform arbitrary SQL queries that can be leveraged for privilege escalation among many other actions.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Patch or disable the affected component.

Technical description

Primary and upstream sources