low2.7
CVE-2026-86779
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-obje…
Impact
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.
Affected products
| Product | Affected versions |
|---|---|
| Visualizer WordPress Plugin | before 4.0.6 |
Versions were read from the advisory text. No structured product data has been published for this record yet.