The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts. This vulnerability affects WordPress installations with multiple contributors or users with elevated roles, potentially leadi [truncated]
The Visualizer WordPress plugin before 4.0.6 has a vulnerability allowing users with the Contributor role and above to permanently delete any chart on the site, including those created by other users like administrators, due to insufficient authorization checks. This issue arises from the plugin's failure to perform per-object ownership verification, enabling users with elevated privileges to delete chart [truncated]
The Visualizer WordPress plugin before 4.0.7 has a critical vulnerability allowing users with the Contributor role and above to read the full configuration of any chart on the site. This includes configurations that the plugin's own interface denies them access to. The disclosed configuration can include credentials of a remote data source that a chart reads from. This vulnerability has a CVSS score of 6. [truncated]
