What the vulnerability does
01Description
The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9. This is due to the plugin registering an unauthenticated AJAX action that dispatches to admin-class methods based on a request parameter, without any nonce or capability checks. This makes it possible for unauthenticated attackers to execute administrative functions via the wp-admin/admin-ajax.php endpoint granted they can identify callable method names.
Explanation of Vulnerability in Simple Terms
02Summary
The Chartify WordPress plugin through version 3.5.9 contains a missing authentication vulnerability that allows unauthenticated attackers to modify chart data or settings over the network. No user interaction is required. The vulnerability affects the plugin's integrity but does not expose sensitive information or cause service disruption. Site administrators should update to a version newer than 3.5.9.
What an attacker can do
03Attacker Capabilities
Modify chart data or plugin settings without logging in.
Potential impact on your site
04Site Impact
Attackers can alter charts displayed on your site without your knowledge or permission.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
October 8, 2025
CVE published
April 8, 2026
Record updated
