Vulnerabilities / iChart – Easy Charts and Graphs / WPSEC-2026-1724
iChart – Easy Charts and Graphs <= 2.2.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Post Duplication
Medium 5.4
CWE-862Fixed in 2.2.3
- ID
- WPSEC-2026-1724
- Plugin
- iChart – Easy Charts and Graphs (ichart)
- Affected
- all versions before 2.2.3
- Remediation
- Update to 2.2.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- iChart – Easy Charts and Graphs on WPSec AttackSurface
- Fix released
- Published
Description
The iChart plugin for WordPress is vulnerable to unauthorized post duplication via the qcld_ai_duplicate_chart AJAX action in all versions up to, and including, 2.2.2. This is due to a missing capability check and no restriction on the type of the source post, with only a nonce check, and that nonce was exposed to all logged-in users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to copy the title, content and metadata of arbitrary posts, including private and draft posts, into new published chart posts and to read the copied title in the response.
References
- https://wpsec.com/vuln/WPSEC-2026-1724/
- https://plugins.svn.wordpress.org/ichart/tags/2.2.3/
- https://wordpress.org/plugins/ichart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS