{“lastseen”:”2026-05-08T18:03:35″,”description”:”The Chartify WordPress Chart plugin contains a missing authentication vulnerability in all versions up to and including 3.5.9. The plugin registers an unauthenticated AJAX action that dispatches to admin-class methods based on a request parameter…”,”published”:”2026-05-08T00:00:00″,”modified”:”2026-05-08T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress Chart 3.5.9 Missing Authentication”,”source”:””,”references”:””,”id”:”PACKETSTORM:220609″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-11171″],”sourceData”:”CVE-2025-11171: Missing Authentication in Chartify WordPress Plugin\\n \\n [](https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2025-11171)\\n [](https:\/\/nvd.nist.gov\/vuln-metrics\/cvss\/v3-calculator)\\n [](https:\/\/wordpress.org\/plugins\/chart-builder\/)\\n [](https:\/\/cwe.mitre.org\/data\/definitions\/306.html)\\n [](https:\/\/www.wordfence.com\/)\\n \\n \\u003e **Keywords:** CVE-2025-11171, Chartify WordPress vulnerability, missing authentication, WordPress security, unauthenticated AJAX exploit, WordPress plugin vulnerability, CWE-306, WordPress chart plugin security, authentication bypass, WordPress CVE 2025\\n \\n ## Table of Contents\\n \\n – [Overview](#overview)\\n – [Vulnerability Details](#vulnerability-details)\\n – [Technical Analysis](#technical-details)\\n – [Attack Vector](#attack-vector)\\n – [Remediation Guide](#remediation)\\n – [CVSS Metrics](#cvss-v31-metrics)\\n – [References](#references)\\n – [Security Contact](#contact)\\n \\n ## Overview\\n \\n **Chartify WordPress Plugin Authentication Bypass Vulnerability (CVE-2025-11171)** – Critical security flaw allowing unauthenticated access to administrative functions in WordPress chart building plugin.\\n \\n A critical authentication bypass vulnerability was discovered in the Chartify WordPress Chart Plugin that allows unauthenticated attackers to execute administrative functions.\\n \\n **Discovered by:** Kai Aizen \\u0026 Avraham Shemesh (SnailSploit) \\n **Published:** October 7, 2025 \\n **CVSS Score:** 5.3 (Medium) \\n **CWE:** CWE-306 – Missing Authentication for Critical Function \\n **Plugin:** Chartify \u2013 WordPress Chart Plugin \\n **Attack Type:** Unauthenticated AJAX Admin Function Execution \\n **Required Privileges:** None (Unauthenticated Attack)\\n \\n ## Vulnerability Details\\n \\n ### Description\\n \\n The Chartify WordPress Chart Plugin contains a missing authentication vulnerability in all versions up to and including 3.5.9. The plugin registers an unauthenticated AJAX action that dispatches to admin-class methods based on a request parameter without any nonce or capability checks.\\n \\n ### Impact\\n \\n This vulnerability allows unauthenticated attackers to:\\n – Execute administrative functions via the `wp-admin\/admin-ajax.php` endpoint\\n – Bypass authentication controls\\n – Potentially manipulate plugin settings and data\\n \\n ### Affected Versions\\n \\n – **Vulnerable:** All versions \u2264 3.5.9\\n – **Patched:** Version 3.6.0 and above\\n \\n ### CVSS v3.1 Metrics\\n \\n “`\\n CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N\\n “`\\n \\n | Metric | Value |\\n |——–|——-|\\n | Attack Vector | Network (AV:N) |\\n | Attack Complexity | Low (AC:L) |\\n | Privileges Required | None (PR:N) |\\n | User Interaction | None (UI:N) |\\n | Scope | Unchanged (S:U) |\\n | Confidentiality | None (C:N) |\\n | Integrity | Low (I:L) |\\n | Availability | None (A:N) |\\n \\n ## Technical Details\\n \\n The vulnerability exists in the AJAX handler implementation where:\\n \\n 1. The plugin registers an unauthenticated AJAX action\\n 2. This action dispatches to admin-class methods based on request parameters\\n 3. No nonce validation is performed\\n 4. No capability checks are implemented\\n 5. Attackers who can identify callable method names can invoke them directly\\n \\n ### Attack Vector\\n \\n “`\\n POST \/wp-admin\/admin-ajax.php\\n “`\\n \\n The vulnerability can be exploited through the WordPress admin-ajax.php endpoint without authentication, provided the attacker can identify valid method names.\\n \\n ## Remediation\\n \\n ### For Site Administrators\\n \\n **Immediate Action Required:**\\n \\n 1. Update to Chartify version **3.6.0** or later immediately\\n 2. Review your site’s access logs for suspicious AJAX requests to `admin-ajax.php`\\n 3. If you cannot update immediately, consider temporarily disabling the plugin\\n \\n ### Update Instructions\\n \\n 1. Navigate to **Plugins \\u003e Installed Plugins** in WordPress admin\\n 2. Locate \\”Chartify \u2013 WordPress Chart Plugin\\”\\n 3. Click **Update Now** to upgrade to version 3.6.0 or later\\n 4. Verify the update was successful\\n \\n ### For Developers\\n \\n Ensure all AJAX handlers implement proper security controls:\\n \\n “`php\\n \/\/ Example of proper AJAX security\\n add_action(‘wp_ajax_your_action’, ‘your_callback’);\\n \\n function your_callback() {\\n \/\/ Verify nonce\\n check_ajax_referer(‘your_nonce_action’, ‘nonce’);\\n \\n \/\/ Check capabilities\\n if (!current_user_can(‘manage_options’)) {\\n wp_die(‘Unauthorized’);\\n }\\n \\n \/\/ Your secure code here\\n }\\n “`\\n \\n ## Timeline\\n \\n – **October 7, 2025** – Vulnerability publicly disclosed\\n – **October 8, 2025** – CVE record updated\\n – **Version 3.6.0** – Patch released by plugin vendor\\n \\n ## References\\n \\n – [Wordfence Intelligence Database Entry](https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/chart-builder\/chartify-wordpress-chart-plugin-359-missing-authentication-for-administrative-function)\\n – [WordPress Plugin Trac](https:\/\/plugins.trac.wordpress.org\/browser\/chart-builder)\\n – [MITRE CVE Entry](https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2025-11171)\\n \\n ## Credits\\n \\n **Researchers:** \\n – **Kai Aizen** – SnailSploit \\n – **Avraham Shemesh** – SnailSploit\\n \\n **Disclosure Process:** Coordinated through Wordfence Bug Bounty Program\\n \\n ## Disclaimer\\n \\n This information is provided for security research and defensive purposes only. Any exploitation of this vulnerability for malicious purposes is illegal and unethical. Always obtain proper authorization before testing systems you do not own.\\n \\n ## Contact\\n \\n For questions or additional information about this vulnerability:\\n – **Email:** kai@owasp.com\\n – **Website:** [snailsploit.com](https:\/\/snailsploit.com)\\n – **Organization:** SnailSploit Security Research\\n \\n —\\n \\n \\n \\n *Last updated: October 13, 2025*\\n \\n \\u003c!– snailsploit-backlink:start –\\u003e\\n \\n —\\n \\n ## \ud83d\udcda Documentation \\u0026 Author\\n \\n This project’s full writeup, methodology, and related research lives at:\\n \\n **[https:\/\/snailsploit.com\/security-research\/cves\/cve-2025-11171\/](https:\/\/snailsploit.com\/security-research\/cves\/cve-2025-11171\/)**\\n \\n Created by **Kai Aizen** \u2014 independent offensive security researcher.\\n \\n [snailsploit.com](https:\/\/snailsploit.com) \u00b7 [Research](https:\/\/snailsploit.com\/research) \u00b7 [Frameworks](https:\/\/snailsploit.com\/frameworks) \u00b7 [GitHub](https:\/\/github.com\/SnailSploit) \u00b7 [LinkedIn](https:\/\/linkedin.com\/in\/kaiaizen) \u00b7 [ResearchGate](https:\/\/www.researchgate.net\/profile\/Kai-Aizen-2) \u00b7 [X\/Twitter](https:\/\/x.com\/SnailSploit)\\n \\n \\u003e *Same attack. Different substrate.*\\n \\n \\u003c!– snailsploit-backlink:end –\\u003e”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220609″,”cvss”:{“score”:5.3,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220609\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-08T18:03:35″,”description”:”The Chartify WordPress Chart plugin contains a missing authentication vulnerability in all versions up to and including 3.5.9. The plugin registers an unauthenticated AJAX action…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,22,12,21,13,53,7,11,5],"class_list":["post-52568","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-53","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n