CVE-2026-86779: Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with the Contributor role or a higher role can exploit it. The user does not need to own the chart they delete.
What content is at risk?
Any chart on the site may be permanently deleted, including charts created by administrators or other users.
Are sites using the affected plugin version exposed by default?
A site is exposed when it uses a Visualizer version before 4.0.6 and has users with Contributor-level or higher access. Exploitation requires an authenticated account with one of those roles.
How can I determine whether a deletion may be malicious?
Review chart deletions involving Contributor-level users, particularly where the deleted chart was created by a different user or an administrator. The affected authorization check does not enforce ownership.