CVE-2026-8689

Name of the Vulnerable Software and Affected Versions Visualizer: Tables and Charts Manager for WordPress versions prior to 3.11.15

Description Missing authorization allows authenticated users with Subscriber-level access and above to create arbitrary chart posts and access or modify chart data belonging to other users, including administrators. The issue stems from a lack of capability checks in the renderChartPages() and uploadData() functions. Specifically, the AJAX actions 'wp ajax visualizer-create-chart' and 'wp ajax visualizer-edit-chart' invoke renderChartPages() without a current user can() check. Additionally, the 'wp ajax visualizer-upload-data' action invokes uploadData(), which lacks a capability check and uses a nonce validation process without an action argument, allowing it to be bypassed.

Recommendations Update to a version newer than 3.11.14. As a temporary mitigation, restrict access to the renderChartPages() and uploadData() functions.