CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on the getQueryData() function in all versions up to, and including, 3.10.15. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform arbitrary SQL queries that can be leveraged for privilege escalation among many other actions.
Explanation of Vulnerability in Simple Terms
The Visualizer plugin for WordPress does not properly check user permissions before allowing access to sensitive functions. A logged-in user with low privileges can read, modify, or delete data they should not have access to, including charts, tables, and configuration settings created by other users or administrators.
What an attacker can do
Read, modify, or delete charts and tables belonging to other users without authorization.
Potential impact on your site
Unauthorized users can tamper with or destroy published charts and data visualizations across your site.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
