Visualizer registered its Gutenberg REST routes (/wp-json/visualizer/v1/upload-data, /update-chart, /get-permission-data and the chart_data REST field) without any permission check, so any unauthenticated visitor could reach them. By POSTing a crafted URL to the upload-data route an attacker made the site fetch an arbitrary address, allowing blind server-side request forgery against hosts reachable only from the server, and could also read or overwrite chart data. Fixed in 3.3.1 by requiring the ‘edit_posts’ capability in each REST callback.
This vulnerability affects the following application versions:
- Visualizer – Tables & Charts Manager 3.1.0
- Visualizer – Tables & Charts Manager 3.1.1
- Visualizer – Tables & Charts Manager 3.1.2
- Visualizer – Tables & Charts Manager 3.1.3
- Visualizer – Tables & Charts Manager 3.2.0
- Visualizer – Tables & Charts Manager 3.2.1
- Visualizer – Tables & Charts Manager 3.3.0