[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fb3K0LUDxZg86tXXsVD9ZST3tcF62QntVAd6W3Uivllc":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-13468","visualizer-missing-authorization-to-unauthenticated-sensitive-information-disclosure-via-visualizerv1actioncharttype-res","Visualizer \u003C= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via \u002Fvisualizer\u002Fv1\u002Faction\u002F{chart}\u002F{type}\u002F REST Endpoint","The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site — including charts in draft, private, pending, future, or trash status — as CSV, Excel, or HTML via the \u002Fwp-json\u002Fvisualizer\u002Fv1\u002Faction\u002F{chart}\u002F{type}\u002F REST endpoint. This bypass is particularly impactful because the standard WordPress REST endpoint for the non-public 'visualizer' custom post type correctly enforces capability checks and returns HTTP 401 to unauthenticated callers, whereas this plugin-registered route circumvents that protection entirely.","visualizer",null,"\u003C=4.0.3","4.0.4","high",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Missing Authorization","2026-06-30 15:03:18","2026-07-01 03:43:35",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F45dbcc5e-2746-4a55-a1d1-a7c67fa2950e?source=api-prod",1,[22,23,24,25,26,27,28,29],"CHANGELOG.md","classes\u002FVisualizer\u002FModule\u002FFrontend.php","classes\u002FVisualizer\u002FPlugin.php","css\u002Fmedia.css","index.php","readme.md","readme.txt","vendor\u002Fcodeinwp\u002Fthemeisle-sdk\u002FCHANGELOG.md","researched",false,3,"# Exploitation Research Plan: CVE-2026-13468 (Visualizer Sensitive Information Disclosure)\n\n## 1. Vulnerability Summary\nThe **Visualizer** plugin for WordPress is vulnerable to an authorization bypass via its custom REST API endpoint `\u002Fvisualizer\u002Fv1\u002Faction\u002F{chart}\u002F{type}\u002F`. While the standard WordPress REST API for the `visualizer` custom post type correctly enforces permissions, this specific plugin-registered route lacks any capability checks or nonce verification in its `permission_callback`. This allows unauthenticated attackers to disclose the full data contents of any chart (including those in Draft, Private, or Trash status) by exporting them to CSV, Excel, or HTML formats.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-json\u002Fvisualizer\u002Fv1\u002Faction\u002F{chart}\u002F{type}\u002F`\n- **Base Route:** `visualizer\u002Fv1` (as defined by `VISUALIZER_REST_VERSION` in `index.php`)\n- **HTTP Methods:** `GET` (for data export actions) and `POST` (for saving).\n- **Vulnerable Parameters:**\n  - `{chart}`: The ID of the visualizer chart (Post ID).\n  - `{type}`: The action to perform. Valid types defined in `get_actions()`: `csv`, `xls`, `print`, `copy`, `image`.\n- **Authentication:** None (Unauthenticated).\n- **Preconditions:** At least one chart must exist (any status). The attacker needs to guess or iterate through chart IDs.\n\n## 3. Code Flow\nThe vulnerability exists in `classes\u002FVisualizer\u002FModule\u002FFrontend.php`:\n\n1. **Route Registration:** In `endpoint_register()`, the route is defined with a flawed `permission_callback`.\n2. **Flawed Authorization:** The `permission_callback` logic:\n   ```php\n   'permission_callback' => function ( WP_REST_Request $request ) {\n       $chart_id = filter_var( sanitize_text_field( $request->get_param( 'chart' ), FILTER_VALIDATE_INT ) );\n       if ( ! empty( $chart_id ) && in_array( $request->get_param( 'type' ), array( 'save', 'cancel' ), true ) ) {\n           return true; \u002F\u002F Explicitly allows save\u002Fcancel without checks\n       }\n       \u002F\u002F Vulnerable line: Defaults to true if the filter is not hooked (which it isn't in free version)\n       return ! empty( $chart_id ) && apply_filters( 'visualizer_pro_show_chart', true, $chart_id );\n   },\n   ```\n3. **Action Execution:** If the callback returns `true`, `perform_action` is invoked.\n4. **Data Retrieval:** `perform_action` (and its subsequent calls like `getCSV`) fetches the post meta and associated data for the given `chart_id` regardless of post status (`private`, `draft`, etc.) because the REST API context bypasses standard frontend visibility checks.\n\n## 4. Nonce Acquisition Strategy\nBased on the source code in `classes\u002FVisualizer\u002FModule\u002FFrontend.php`, **no nonce is required** for the `GET` requests to this endpoint.\n\nThe code explicitly mentions:\n> \"let save and cancel go without any check as past version of pro did not send the X-WP-Nonce\"\n\nThe `permission_callback` for other actions (like `csv`) relies solely on the `visualizer_pro_show_chart` filter, which defaults to `true` and does not perform any `wp_verify_nonce` or `check_ajax_referer` checks.\n\n## 5. Exploitation Strategy\nThe goal is to demonstrate unauthenticated access to a private chart's data.\n\n### Step 1: Enumerate\u002FGuess Chart ID\nSince IDs are incremental integers, an attacker can iterate from 1 upwards.\n\n### Step 2: Request Export\nTarget the CSV export action.\n\n- **Request Type:** `GET`\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fvisualizer\u002Fv1\u002Faction\u002F{ID}\u002Fcsv\u002F`\n- **Headers:** None required.\n\n### Step 3: Parse Response\nThe server will respond with a CSV file containing the data used to populate the chart.\n\n## 6. Test Data Setup\nTo verify the vulnerability, create a chart that should be inaccessible.\n\n1. **Log in as Admin.**\n2. **Create a Chart:** Navigate to Visualizer -> Library -> Add New. Create a \"Table\" chart with dummy sensitive data (e.g., \"Salary\" column with \"User A: $100,000\").\n3. **Set Status to Private:** Edit the newly created chart (it's a custom post type `visualizer`) and set its visibility to **Private** or its status to **Draft**.\n4. **Note the ID:** Identify the Post ID of the chart from the URL (e.g., `post=123`).\n\n## 7. Expected Results\n- **Unauthenticated Access:** A `GET` request to `\u002Fwp-json\u002Fvisualizer\u002Fv1\u002Faction\u002F123\u002Fcsv\u002F` should return `HTTP 200 OK`.\n- **Data Disclosure:** The response body should contain the CSV data of the \"Private\" chart.\n- **Comparison:** A standard REST request to `\u002Fwp-json\u002Fwp\u002Fv2\u002Fvisualizer\u002F123` should return `HTTP 401 Unauthorized` or `HTTP 403 Forbidden` for unauthenticated users, highlighting the bypass in the custom endpoint.\n\n## 8. Verification Steps\nAfter the HTTP request, verify the content:\n```bash\n# Verify the response contains the sensitive setup data\necho \"Checking if CSV data was leaked...\"\nif [[ \"$RESPONSE_BODY\" == *\"Salary\"* ]]; then\n    echo \"SUCCESS: Sensitive data disclosed.\"\nelse\n    echo \"FAILURE: Data not found in response.\"\nfi\n```\n\n## 9. Alternative Approaches\nIf `csv` type is restricted or behaves unexpectedly, try other export types:\n- **XLS:** `\u002Fwp-json\u002Fvisualizer\u002Fv1\u002Faction\u002F{ID}\u002Fxls\u002F`\n- **Copy:** `\u002Fwp-json\u002Fvisualizer\u002Fv1\u002Faction\u002F{ID}\u002Fcopy\u002F` (often returns JSON or raw data)\n- **Print:** `\u002Fwp-json\u002Fvisualizer\u002Fv1\u002Faction\u002F{ID}\u002Fprint\u002F` (returns HTML view of the data)\n\nIf the site is using a custom table prefix or modified REST base, check the source of the main page for `visualizer_v1` strings to confirm the route.","The Visualizer plugin for WordPress is vulnerable to an authorization bypass due to a flawed permission_callback in its custom REST API endpoint \u002Fvisualizer\u002Fv1\u002Faction\u002F{chart}\u002F{type}\u002F. This allows unauthenticated attackers to disclose the full data contents of any chart, including those in private, draft, or trash status, by exporting them to CSV, Excel, or HTML.","\u002F* classes\u002FVisualizer\u002FModule\u002FFrontend.php lines 152-163 *\u002F\n'permission_callback' => function ( WP_REST_Request $request ) {\n\t$chart_id   = filter_var( sanitize_text_field( $request->get_param( 'chart' ), FILTER_VALIDATE_INT ) );\n\tif ( ! empty( $chart_id ) && in_array( $request->get_param( 'type' ), array( 'save', 'cancel' ), true ) ) {\n\t\t\u002F\u002F let save and cancel go without any check as past version of pro\n\t\t\u002F\u002F did not send the X-WP-Nonce\n\t\t\u002F\u002F we can change this at a later date.\n\t\treturn true;\n\t}\n\treturn ! empty( $chart_id ) && apply_filters( 'visualizer_pro_show_chart', true, $chart_id );\n},","--- \u002Fclasses\u002FVisualizer\u002FModule\u002FFrontend.php\n+++ \u002Fclasses\u002FVisualizer\u002FModule\u002FFrontend.php\n@@ -153,14 +153,25 @@\n \t\t\t\t\t),\n \t\t\t\t),\n \t\t\t\t'permission_callback' => function ( WP_REST_Request $request ) {\n-\t\t\t\t\t$chart_id   = filter_var( sanitize_text_field( $request->get_param( 'chart' ), FILTER_VALIDATE_INT ) );\n-\t\t\t\t\tif ( ! empty( $chart_id ) && in_array( $request->get_param( 'type' ), array( 'save', 'cancel' ), true ) ) {\n-\t\t\t\t\t\t\u002F\u002F let save and cancel go without any check as past version of pro\n-\t\t\t\t\t\t\u002F\u002F did not send the X-WP-Nonce\n-\t\t\t\t\t\t\u002F\u002F we can change this at a later date.\n-\t\t\t\t\t\treturn true;\n+\t\t\t\t\t$chart_id = absint( $request->get_param( 'chart' ) );\n+\t\t\t\t\tif ( ! $chart_id ) {\n+\t\t\t\t\t\treturn false;\n \t\t\t\t\t}\n-\t\t\t\t\treturn ! empty( $chart_id ) && apply_filters( 'visualizer_pro_show_chart', true, $chart_id );\n+\n+\t\t\t\t\t$chart = get_post( $chart_id );\n+\t\t\t\t\tif ( ! $chart || Visualizer_Plugin::CPT_VISUALIZER !== $chart->post_type ) {\n+\t\t\t\t\t\treturn false;\n+\t\t\t\t\t}\n+\n+\t\t\t\t\tif ( in_array( $request->get_param( 'type' ), array( 'save', 'cancel' ), true ) ) {\n+\t\t\t\t\t\treturn current_user_can( 'edit_post', $chart_id );\n+\t\t\t\t\t}\n+\n+\t\t\t\t\tif ( 'publish' !== $chart->post_status ) {\n+\t\t\t\t\t\treturn current_user_can( 'edit_post', $chart_id );\n+\t\t\t\t\t}\n+\n+\t\t\t\t\treturn apply_filters( 'visualizer_pro_show_chart', true, $chart_id );\n \t\t\t\t},","An unauthenticated attacker can exploit this vulnerability by sending a GET request to the \u002Fwp-json\u002Fvisualizer\u002Fv1\u002Faction\u002F{chart_id}\u002F{type}\u002F endpoint. The attacker needs to guess or iterate through chart IDs (incremental integers) and specify an export type such as 'csv' or 'xls'. Because the permission_callback defaults to true for export actions and does not check post status or user capabilities, the plugin will serve the full data content of the chart, even if it is set to private or draft visibility. This bypasses the standard WordPress REST API access controls for the 'visualizer' custom post type.","gemini-3-flash-preview","2026-07-25 13:08:46","2026-07-25 13:09:23",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","4.0.3","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvisualizer\u002Ftags\u002F4.0.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fvisualizer.4.0.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvisualizer\u002Ftags\u002F4.0.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fvisualizer.4.0.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvisualizer\u002Ftags"]