CVE-2026-13468: Visualizer Plugin Auth Bypass Vulnerability

CVE-2026-13468 Overview

CVE-2026-13468 is an authorization bypass vulnerability affecting the Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress. All versions up to and including 4.0.3 are affected. The plugin fails to verify user authorization on a custom REST endpoint, allowing unauthenticated attackers to access and export chart data via the /wp-json/visualizer/v1/action/{chart}/{type}/ route. Attackers can retrieve charts in draft, private, pending, future, or trash status as CSV, Excel, or HTML files. The flaw is tracked as CWE-862: Missing Authorization.

Critical Impact
Unauthenticated remote attackers can export the contents of any Visualizer chart on a vulnerable WordPress site, including non-public charts, leading to disclosure of sensitive business data.

Affected Products

Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress
All plugin versions up to and including 4.0.3
WordPress sites exposing the plugin-registered REST API route

Discovery Timeline

2026-07-01 - CVE-2026-13468 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13468

Vulnerability Analysis

The Visualizer plugin registers a custom REST API route at /wp-json/visualizer/v1/action/{chart}/{type}/ that handles chart export operations. The route accepts a chart identifier and an export type such as CSV, Excel, or HTML. The endpoint does not enforce capability or authentication checks on incoming requests. As a result, unauthenticated attackers can invoke the route and retrieve chart content directly.

The standard WordPress REST endpoint for the visualizer custom post type behaves correctly. That endpoint validates the caller against the non-public post type and returns HTTP 401 for unauthenticated requests. The plugin-registered route bypasses that protection entirely by implementing its own handler without equivalent access control.

Because the vulnerable route serves any chart by ID, an attacker can enumerate identifiers and exfiltrate charts regardless of their post status. This includes drafts, private posts, pending review, scheduled future posts, and items in trash.

Root Cause

The root cause is missing authorization on the REST route handler. The plugin registers the endpoint without a permission_callback that verifies user capabilities such as read_private_posts or edit_post. The handler proceeds to load and serialize the chart data regardless of the requester's identity or the target post status.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker sends an HTTP GET request to the plugin's REST route with a chart ID and desired output format. The server returns the chart contents in the requested format. No credentials, tokens, or session state are required. Reference the Wordfence Vulnerability Report and the WordPress Visualizer Module Code for the affected handler.

Detection Methods for CVE-2026-13468

Indicators of Compromise

HTTP requests to /wp-json/visualizer/v1/action/ paths from unauthenticated sources, particularly those requesting CSV, Excel, or HTML output types.
Sequential or enumerative access patterns targeting incrementing chart IDs on the Visualizer REST route.
Web server access logs showing HTTP 200 responses to the vulnerable endpoint without a valid WordPress authentication cookie or nonce.

Detection Strategies

Review WordPress and web server access logs for requests matching the pattern /wp-json/visualizer/v1/action/{id}/{type}/ where the response size indicates chart data exfiltration.
Deploy web application firewall rules that inspect the Visualizer REST route and require authenticated sessions for chart export operations.
Compare requestor IPs against threat intelligence feeds for known scanners targeting WordPress plugin vulnerabilities.

Monitoring Recommendations

Alert on high-volume requests to any /wp-json/visualizer/ endpoint from a single source IP within a short time window.
Monitor egress traffic from the WordPress host for unusual outbound data volumes that correlate with plugin REST endpoint activity.
Track installation versions of the Visualizer plugin across managed WordPress sites and flag any instance at version 4.0.3 or earlier.

How to Mitigate CVE-2026-13468

Immediate Actions Required

Update the Visualizer plugin to a version later than 4.0.3 that includes the fix referenced in the WordPress Visualizer Changeset.
Audit existing Visualizer charts for sensitive content in draft, private, pending, future, or trash status and rotate or redact any exposed data.
Review web server access logs for prior exploitation attempts against the vulnerable REST route.

Patch Information

The vendor addressed the vulnerability in a release published after version 4.0.3. The corresponding source changes are visible in the WordPress Visualizer Changeset. Site administrators should install the fixed release through the WordPress plugin updater. Additional analysis is available in the Wordfence Vulnerability Report.

Workarounds

Temporarily deactivate the Visualizer plugin until the patched version is installed.
Restrict access to /wp-json/visualizer/v1/action/ at the web server or reverse proxy layer, requiring authenticated sessions to reach the route.
Deploy a WAF rule that blocks unauthenticated requests to the Visualizer REST namespace while a permanent patch is applied.

bash

# Example nginx configuration to require authentication on the vulnerable route
location ~ ^/wp-json/visualizer/v1/action/ {
    if ($http_cookie !~* "wordpress_logged_in_") {
        return 401;
    }
    try_files $uri $uri/ /index.php?$args;
}