{
 "id": "WPSEC-2026-2393",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2393/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2393/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2393/index.md",
 "title": "iChart – Easy Charts and Graphs <= 2.2.3 - Unauthenticated Server-Side Request Forgery via CSV Fetch",
 "description": "The iChart plugin for WordPress is vulnerable to Server-Side Request Forgery via the qcld_ai_fetch_raw_csv AJAX action in versions 2.1.8 up to, and including, 2.2.3. This is due to a user-supplied URL being passed to wp_remote_get without validation, with the action registered for unauthenticated users and protected only by a nonce printed on the front end. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and read data from internal services. The response is returned as parsed CSV rows.",
 "plugin": {
  "slug": "ichart",
  "name": "iChart – Easy Charts and Graphs",
  "full_name": "iChart – Easy Charts and Graphs",
  "wordpress_org": "https://wordpress.org/plugins/ichart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ichart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ichart"
 },
 "type": "SSRF",
 "cwe": [
  "CWE-918"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.1.8",
    "from_inclusive": true,
    "to": "2.2.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.1.8 before 2.2.4"
  ]
 },
 "introduced_in": "2.1.8",
 "fixed_in": "2.2.4",
 "remediation": "Update to 2.2.4 or later.",
 "fix_released": "2026-11-02T14:40:14+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:23:09.601938+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2393/",
  "https://plugins.svn.wordpress.org/ichart/tags/2.2.4/",
  "https://wordpress.org/plugins/ichart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ichart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}