Vulnerabilities / iChart – Easy Charts and Graphs / WPSEC-2026-2393
iChart – Easy Charts and Graphs <= 2.2.3 - Unauthenticated Server-Side Request Forgery via CSV Fetch
High 7.2
CWE-918Fixed in 2.2.4
- ID
- WPSEC-2026-2393
- Plugin
- iChart – Easy Charts and Graphs (ichart)
- Affected
- from 2.1.8 before 2.2.4
- Remediation
- Update to 2.2.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-918
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- iChart – Easy Charts and Graphs on WPSec AttackSurface
- Fix released
- Published
Description
The iChart plugin for WordPress is vulnerable to Server-Side Request Forgery via the qcld_ai_fetch_raw_csv AJAX action in versions 2.1.8 up to, and including, 2.2.3. This is due to a user-supplied URL being passed to wp_remote_get without validation, with the action registered for unauthenticated users and protected only by a nonce printed on the front end. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and read data from internal services. The response is returned as parsed CSV rows.
References
- https://wpsec.com/vuln/WPSEC-2026-2393/
- https://plugins.svn.wordpress.org/ichart/tags/2.2.4/
- https://wordpress.org/plugins/ichart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS