CVE-2026-13468 is an authorization bypass vulnerability (CWE-862) in the Visualizer – Tables & Charts Manager with Built-in AI Generator WordPress plugin. The vulnerability affects all versions up to and including 4.0.3. It occurs because the plugin's REST endpoint /wp-json/visualizer/v1/action/{chart}/{type}/ does not enforce proper authorization checks, allowing unauthenticated users to export chart data regardless of the chart's visibility status (including draft, private, pending, future, or trash). This bypass circumvents the standard WordPress REST API protections that normally restrict access to non-public visualizer custom post types, which return HTTP 401 to unauthorized requests. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

An unauthenticated attacker can access and export the contents of any visualizer chart on the affected WordPress site, including charts not publicly visible (draft, private, pending, future, or trash). This leads to unauthorized disclosure of potentially sensitive data contained in these charts. There is no impact on integrity or availability reported. The vulnerability undermines the intended access controls of the plugin's chart data export functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restrict access to the REST endpoint if possible via web application firewall rules or other access controls. Monitor vendor communications for updates and apply official patches promptly once released.