What the vulnerability does
01Description
The DASHBOARD BUILDER – WordPress plugin for Charts and Graphs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.7. This is due to missing nonce validation on the settings handler in dashboardbuilder-admin.php. This makes it possible for unauthenticated attackers to modify the stored SQL query and database credentials used by the [show-dashboardbuilder] shortcode via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The modified SQL query is subsequently executed on the front-end when the shortcode is rendered, enabling arbitrary SQL injection and data exfiltration through the publicly visible chart output.
Explanation of Vulnerability in Simple Terms
02Summary
The Dashboard Builder WordPress plugin versions 1.5.7 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unauthorized actions on the site without the admin's knowledge or consent. This could allow modification of plugin settings or data.
What an attacker can do
03Attacker Capabilities
Trick a logged-in admin into visiting a malicious page that performs unauthorized actions on the site.
Potential impact on your site
04Site Impact
An attacker can modify plugin settings or data if they trick your admin into visiting a malicious link while logged in.
Conditions required to exploit
05Prerequisites
Admin must be logged in and visit an attacker-controlled webpage; no special plugin configuration required.
Key dates
06Disclosure timeline
January 14, 2026
CVE published
April 8, 2026
Record updated
