CVE-2026-13468 is an authorization bypass vulnerability in the Visualizer – Tables & Charts Manager with Built-in AI Generator WordPress plugin affecting all versions up to and including 4.0.3. The vulnerability exists because the plugin's custom REST endpoint /wp-json/visualizer/v1/action/{chart}/{type}/ does not enforce proper authorization checks, allowing unauthenticated users to export chart data in CSV, Excel, or HTML formats. This bypass contrasts with the standard WordPress REST endpoint for the visualizer custom post type, which correctly enforces capability checks and returns HTTP 401 to unauthorized requests. The vulnerability is classified under CWE-862 (Missing Authorization).

An unauthenticated attacker can access and export the contents of any visualizer chart on the affected WordPress site, including charts not publicly available (draft, private, pending, future, or trashed). This exposure can lead to unauthorized disclosure of potentially sensitive data contained within these charts. The vulnerability does not affect data integrity or availability but has a high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST endpoint by disabling or limiting the plugin's REST API routes via custom code or security plugins. Monitor for updates from themeisle and apply any official patches promptly once available.