Description:

The plugin does not properly lock its Pro features which could allow low users such as contribute to bypass the restriction and use them.

How to reproduce:

1. Log-In user contribute+
2. Add a new Library (Visualizer > Add New)
3. Choose a library (Example: Line)
4. When the next click there is a request like the image below.

5. Change the value in the parameter type to bubble

nonce=65c812e22e&type=bubble&chart-library=GoogleCharts

6. If the value has been changed as above, then create a chart.

Example a post with a shortcode

Reference:

https://wpscan.com/vulnerability/60eb1d98-8bf9-495c-bac8-fe46cd9f97df

Technical info

• WordPress version: 6.1.1
• Plugin version: 3.9.3