WordPress security changelog
HIGH CVE-2026-13468 Deferred

Visualizer – Tables & Charts Manager with Built-in AI Generator: A security weakness

Visualizer – Tables & Charts Manager with Built-in AI Generator is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.0.3.

CVE / CNA score 7.5 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Visualizer – Tables & Charts Manager with Built-in AI Generator
Plugin slug
visualizer
Affected
<= 4.0.3
Safe version
> 4.0.3
Published
Jul 01, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published Jul 01, 2026 and is one of 13 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Visualizer – Tables & Charts Manager with Built-in AI Generator to a release after 4.0.3, or disable and remove it until a fixed version is available.

Source record

Technical description

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site — including charts in draft, private, pending, future, or trash status — as CSV, Excel, or HTML via the /wp-json/visualizer/v1/action/{chart}/{type}/ REST endpoint. This bypass is particularly impactful because the standard WordPress REST endpoint for the non-public 'visualizer' custom post type correctly enforces capability checks and returns HTTP 401 to unauthenticated callers, whereas this plugin-registered route circumvents that protection entirely.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Primary and upstream sources