What the vulnerability does
01Description
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including 3.7.9. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Explanation of Vulnerability in Simple Terms
02Summary
The Visualizer plugin for WordPress improperly deserializes untrusted data, allowing authenticated users to execute arbitrary PHP code on the site. An attacker with a low-privilege account (such as a subscriber or contributor) can craft malicious serialized objects to run their own code with full site access. All versions up to 3.7.9 are affected.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site with full administrative privileges.
Potential impact on your site
04Site Impact
A low-privilege user can take over the entire site, steal data, modify content, or install backdoors.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress account (subscriber, contributor, or editor role).
Key dates
06Disclosure timeline
July 18, 2022
CVE published
April 8, 2026
Record updated
