CVE-2026-13468

Name of the Vulnerable Software and Affected Versions The Visualizer – Tables & Charts Manager with Built-in AI Generator versions prior to 4.0.4

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to access and export the contents of any chart on the site, including those with draft, private, pending, future, or trash status, in CSV, Excel, or HTML formats. The issue occurs via the /wp-json/visualizer/v1/action/{chart}/{type}/ REST endpoint. This is significant because the plugin-registered route bypasses the capability checks enforced by the standard WordPress REST endpoint for the non-public 'visualizer' custom post type.

Recommendations Update to a version newer than 4.0.3. Restrict access to the /wp-json/visualizer/v1/action/{chart}/{type}/ REST endpoint to minimize the risk of exploitation.