CVE-2026-13468: Visualizer Plugin WordPress REST API Authorization Bypass

Technical summary

The vulnerability stems from improper authorization verification in the plugin's custom REST endpoint at /wp-json/visualizer/v1/action/{chart}/{type}/. When users request data exports (CSV, Excel, HTML) through this route, the plugin does not validate whether the requester has permission to access that specific chart. The standard WordPress REST endpoint for the 'visualizer' custom post type correctly enforces capability checks and rejects unauthenticated requests with HTTP 401. However, the plugin's alternate route bypasses this protection entirely, allowing unauthenticated attackers to enumerate and export chart data regardless of post status (draft, private, pending, future, or trash). This is classified as an authorization bypass issue (CWE-862) where the access control mechanism either fails to restrict access or fails to validate the user's right to perform the requested action.

Business impact

Organizations using this plugin to manage internal dashboards, sensitive metrics, financial charts, or proprietary analysis may inadvertently expose that data to the public internet. Site visitors, competitors, or malicious actors can extract business intelligence, operational metrics, or confidential reporting without authentication. The impact is magnified if charts are used to visualize customer data, revenue, inventory, or strategic planning information. Even charts marked as private or in draft status are vulnerable, undermining content management workflows and confidentiality controls. Additionally, the breach of the plugin's security model—contrasting sharply with WordPress's native protections—may erode trust in the plugin ecosystem and necessitate a comprehensive audit of other REST endpoints and custom integrations.

Affected systems

All versions of the Visualizer plugin through and including 4.0.3 are vulnerable. Any WordPress site running this plugin version is at risk, regardless of whether the charts are visible in the front-end UI or protected by role restrictions. The vulnerability affects all export formats supported by the plugin (CSV, Excel, HTML) and all chart visibility statuses. Sites that have restricted REST API access or use IP-based blocking may experience some mitigation, but the vulnerability remains present within the plugin code itself.

Exploitability

This vulnerability is trivial to exploit. An attacker requires no authentication, no user interaction, and no special network access—only knowledge of the endpoint structure and a chart ID (which can be discovered through systematic enumeration or disclosed inadvertently through page source, API debugging, or social engineering). The attack is automatable at scale, making it feasible for attackers to probe multiple WordPress installations simultaneously. The low barrier to exploitation—network-accessible, no credentials needed, no complex interaction—is reflected in the CVSS 3.1 score of 7.5 (High severity), with a vector indicating high confidentiality impact and no authentication requirement. No known public exploit code has been tracked by CISA, but the technical simplicity means weaponization is likely.

Remediation

Site administrators should immediately update the Visualizer plugin to the patched version that restores proper authorization checks on the affected REST endpoint. Until a patch is available and tested, consider disabling REST API access to the visualizer custom post type if operationally feasible, or restrict REST API access to authenticated users only via security headers or firewall rules. Additionally, audit any charts created on the site to identify which ones contain sensitive data, and consider moving that data to alternative visualization solutions with stronger access controls. After patching, verify that the /wp-json/visualizer/v1/action/ endpoint now correctly returns HTTP 401 for unauthenticated requests, matching the behavior of the standard WordPress REST endpoint.

Patch guidance

Contact the Visualizer plugin vendor or monitor the official WordPress plugin repository for an updated version greater than 4.0.3 that addresses CWE-862 and restores authorization checks. Verify the patch notes confirm the fix applies to the /wp-json/visualizer/v1/action/{chart}/{type}/ endpoint. Before deploying to production, test the update in a staging environment to confirm that your existing chart export workflows remain functional for authorized users and that the endpoint now blocks unauthenticated access. If the vendor has not released a patch within a reasonable timeframe, consider migrating to an alternative charting solution that prioritizes secure-by-default REST API design.

Detection guidance

Monitor web server access logs and WordPress audit plugins for repeated or suspicious requests to /wp-json/visualizer/v1/action/* endpoints, particularly from external IP addresses or unusual geographic locations. Enable REST API logging if available. Look for patterns of POST or GET requests with varying {chart} IDs—this may indicate enumeration. Implement rate limiting on REST endpoints to slow down automated attacks. In WordPress, enable query logging and search for REST requests from unauthenticated users (where `user_id` is 0 or null and the endpoint is `/wp-json/visualizer/`). Cross-reference request timestamps with data access logs from any sensitive systems that depend on or are referenced by these charts. If feasible, use a Web Application Firewall (WAF) to block requests to /wp-json/visualizer/v1/action/* from public networks until the patch is deployed.

Why prioritize this

This vulnerability merits immediate patching due to the convergence of high exploitability, significant confidentiality impact, and the potential for widespread exposure of business-sensitive data. The lack of authentication or user interaction required, combined with the simplicity of the attack vector, creates a low friction exploitation scenario. Organizations with public WordPress sites—especially those using the Visualizer plugin for internal reporting or dashboards—should treat this as a critical priority. The vulnerability is not yet tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog, but the technical accessibility and recent publication date suggest that public tools may emerge quickly. Prioritize patching public-facing WordPress installations before internal or staging environments.

Risk score, explained

The CVSS 3.1 score of 7.5 (High) reflects the combination of network-level accessibility (AV:N), low attack complexity (AC:L), no authentication requirement (PR:N), user-interaction-free exploitation (UI:N), and high confidentiality impact (C:H). The attack does not require a user account, user action, or special network positioning—an attacker anywhere on the internet can export chart data. While integrity and availability are not impacted (a chart cannot be modified or taken offline via this endpoint), the confidentiality breach is severe because sensitive business data, analytics, and strategic metrics may be exposed. The score would be higher (9.0+) if the vulnerability also enabled data modification or denial of service; conversely, it would be lower if authentication or a valid REST API token were required. The 7.5 rating appropriately signals a high-priority issue that demands rapid remediation.

Frequently asked questions