Description
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Visualizer | < 4.0.6 | 4.0.6 |
References
- https://wpscan.com/vulnerability/12a30aca-9b78-4ee8-9cf0-29e579ea5a0b/ exploit vdb-entry technical-description