CVE-2026-19726 describes an incorrect authorization vulnerability (CWE-863) in the Visualizer WordPress plugin versions prior to 4.0.7. The flaw permits users with Contributor role or higher to bypass intended access controls and read the complete configuration of any chart, including those normally inaccessible through the plugin interface. Additionally, an attacker can retrieve configurations for all charts in one request. The disclosed configurations may contain sensitive credentials for remote data sources used by the charts.

Users with Contributor role or higher can access sensitive configuration data of charts, potentially exposing credentials for remote data sources. This unauthorized disclosure can lead to further compromise if the credentials are reused or provide access to external systems. The vulnerability undermines the principle of least privilege by allowing privilege escalation in terms of data access within the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor role assignments and limit access to trusted users only. Monitor for updates from the Visualizer plugin vendor regarding a security patch addressing this authorization issue.