CVE-2026-86779

2.7 lowEPSS 0.3%

Low (2.7). EPSS 0.3% chance of exploitation in the next 30 days.

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.

Severity

CVSS 3.1

2.7 low

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-09-11
Modified: 2026-09-11
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/12a30aca-9b78-4ee8-9cf0-29e579ea5a0b/

Check your stack JSON