CVE-2026-86779

LowCVSS 2.7

Published: 11/09/2026(UTC)Updated: 11/09/2026(UTC)Translated: 11/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification. This allows users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.

Risk Assessment

A user with Contributor privileges can permanently delete charts belonging to others, including administrators, leading to data loss and site disruption. This can be exploited for sabotage.

Recommendation

Update the Visualizer plugin to version 4.0.6 or later. Until then, consider restricting Contributor roles or backing up charts.

Other vulnerabilities in Visualizer WordPress plugin

CVE-2026-14939Medium
The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.

Original NVD description (English source)

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS