CVE-2026-86782: Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Users with the Contributor role or any higher-privileged role can exploit it. The issue is therefore relevant where untrusted or semi-trusted users can authenticate to the WordPress site with Contributor-level access.
What access does an attacker need?
An attacker needs an authenticated WordPress account with at least the Contributor role. No unauthenticated attack path is described.
What content can be modified?
An affected user can publish, rename, or overwrite posts and pages they do not own. This includes private drafts belonging to other users.
What should be done to remediate the issue?
Update the Visualizer WordPress plugin to version 4.0.6 or later. If updating is not immediately possible, restrict Contributor and higher-role access to trusted users because those accounts can modify content outside their ownership.