Vulnerability · Published Aug 16, 2026 · Assigned by WPScan

CVE-2026-19726Visualizer < 4.0.7 - Contributor+ Cross-User Chart Configuration Disclosure

Medium 6.5

In plain English

A medium-severity incorrect authorization in Visualizer from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 72.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own interface denies them, and to retrieve every chart's configuration in a single request. The disclosed configuration can include the credentials of a remote data source a chart reads from.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Visualizer	0 – before 4.0.7

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://wpscan.com/vulnerability/61a1577e-077f-4a00-96b4-860eda48e03b/ exploit, vdb-entry, technical-description