Exploitation Research Plan: CVE-2026-13468 (Visualizer Sensitive Information Disclosure)

1. Vulnerability Summary

The Visualizer plugin for WordPress is vulnerable to an authorization bypass via its custom REST API endpoint /visualizer/v1/action/{chart}/{type}/. While the standard WordPress REST API for the visualizer custom post type correctly enforces permissions, this specific plugin-registered route lacks any capability checks or nonce verification in its permission_callback. This allows unauthenticated attackers to disclose the full data contents of any chart (including those in Draft, Private, or Trash status) by exporting them to CSV, Excel, or HTML formats.

2. Attack Vector Analysis

• Endpoint: /wp-json/visualizer/v1/action/{chart}/{type}/
• Base Route: visualizer/v1 (as defined by VISUALIZER_REST_VERSION in index.php)
• HTTP Methods: GET (for data export actions) and POST (for saving).
• Vulnerable Parameters:
  • {chart}: The ID of the visualizer chart (Post ID).
  • {type}: The action to perform. Valid types defined in get_actions(): csv, xls, print, copy, image.
• Authentication: None (Unauthenticated).
• Preconditions: At least one chart must exist (any status). The attacker needs to guess or iterate through chart IDs.

3. Code Flow

The vulnerability exists in classes/Visualizer/Module/Frontend.php:

1. Route Registration: In endpoint_register(), the route is defined with a flawed permission_callback.
2. Flawed Authorization: The permission_callback logic:

   'permission_callback' => function ( WP_REST_Request $request ) {
       $chart_id = filter_var( sanitize_text_field( $request->get_param( 'chart' ), FILTER_VALIDATE_INT ) );
       if ( ! empty( $chart_id ) && in_array( $request->get_param( 'type' ), array( 'save', 'cancel' ), true ) ) {
           return true; // Explicitly allows save/cancel without checks
       }
       // Vulnerable line: Defaults to true if the filter is not hooked (which it isn't in free version)
       return ! empty( $chart_id ) && apply_filters( 'visualizer_pro_show_chart', true, $chart_id );
   },
   

3. Action Execution: If the callback returns true, perform_action is invoked.
4. Data Retrieval: perform_action (and its subsequent calls like getCSV) fetches the post meta and associated data for the given chart_id regardless of post status (private, draft, etc.) because the REST API context bypasses standard frontend visibility checks.

4. Nonce Acquisition Strategy

Based on the source code in classes/Visualizer/Module/Frontend.php, no nonce is required for the GET requests to this endpoint.

The code explicitly mentions:

"let save and cancel go without any check as past version of pro did not send the X-WP-Nonce"

The permission_callback for other actions (like csv) relies solely on the visualizer_pro_show_chart filter, which defaults to true and does not perform any wp_verify_nonce or check_ajax_referer checks.

5. Exploitation Strategy

The goal is to demonstrate unauthenticated access to a private chart's data.

Step 1: Enumerate/Guess Chart ID

Since IDs are incremental integers, an attacker can iterate from 1 upwards.

Step 2: Request Export

Target the CSV export action.

• Request Type: GET
• URL: http://localhost:8080/wp-json/visualizer/v1/action/{ID}/csv/
• Headers: None required.

Step 3: Parse Response

The server will respond with a CSV file containing the data used to populate the chart.

6. Test Data Setup

To verify the vulnerability, create a chart that should be inaccessible.

1. Log in as Admin.
2. Create a Chart: Navigate to Visualizer -> Library -> Add New. Create a "Table" chart with dummy sensitive data (e.g., "Salary" column with "User A: $100,000").
3. Set Status to Private: Edit the newly created chart (it's a custom post type visualizer) and set its visibility to Private or its status to Draft.
4. Note the ID: Identify the Post ID of the chart from the URL (e.g., post=123).

7. Expected Results

• Unauthenticated Access: A GET request to /wp-json/visualizer/v1/action/123/csv/ should return HTTP 200 OK.
• Data Disclosure: The response body should contain the CSV data of the "Private" chart.
• Comparison: A standard REST request to /wp-json/wp/v2/visualizer/123 should return HTTP 401 Unauthorized or HTTP 403 Forbidden for unauthenticated users, highlighting the bypass in the custom endpoint.

8. Verification Steps

After the HTTP request, verify the content:

# Verify the response contains the sensitive setup data
echo "Checking if CSV data was leaked..."
if [[ "$RESPONSE_BODY" == *"Salary"* ]]; then
    echo "SUCCESS: Sensitive data disclosed."
else
    echo "FAILURE: Data not found in response."
fi

9. Alternative Approaches

If csv type is restricted or behaves unexpectedly, try other export types:

• XLS: /wp-json/visualizer/v1/action/{ID}/xls/
• Copy: /wp-json/visualizer/v1/action/{ID}/copy/ (often returns JSON or raw data)
• Print: /wp-json/visualizer/v1/action/{ID}/print/ (returns HTML view of the data)

If the site is using a custom table prefix or modified REST base, check the source of the main page for visualizer_v1 strings to confirm the route.