CVE-2026-19726

CVE-2026-19726 in the WordPress Visualizer plugin exposes a credential-harvesting opportunity that a CVSS 6.5 score badly understates. The plugin's REST API endpoint `/visualizer endpoints` (verify exact route in your installation) returned all chart configurations in a single request without checking user permissions. Any authenticated user with Contributor role or higher could extract chart configurations containing remote data source credentials for external services. The critical insight is that this isn't a simple IDOR — it's a blast radius failure. Standard authorization bypass lets an attacker obtain one object's data. This endpoint enumerated every chart in the system in one request, meaning a single low-privileged user could harvest the entire credential estate. Those credentials often have permissions beyond reading chart data from their source APIs, making this a pivot point into third-party infrastructure. The vulnerability also reveals a structural mismatch in how WordPress's permission model gets applied to plugin data. WordPress capabilities were designed around content publication trust — Contributors can draft but not publish, which maps to content workflows. When plugin developers map that same role model onto credential-holding objects, they create access that the capability system was never designed to govern: a Contributor legitimately creating a charts visualization now means extracting credentials for external services the Contributor has no operational relationship with. The 4.0.7 patch adds `current_user_can()` checks to the REST endpoint. Verify your installation runs 4.0.7 or later. More importantly, treat this as a class indicator: any WordPress plugin that stores third-party API keys or credentials in plugin-specific data objects and exposes REST endpoints is a candidate for the same pattern. Audit plugins storing credentials for external services, verify their REST endpoints enforce the same permission model as their admin UI, and consider whether credential storage in visualization objects is an acceptable risk for your threat model — the architecture of WordPress plugins makes this pattern nearly inevitable without explicit architectural prevention.

Reviewed through automated stages and approved by a human before publication.