# iChart – Easy Charts and Graphs <= 2.2.3 - Unauthenticated Server-Side Request Forgery via CSV Fetch

- **ID:** WPSEC-2026-2393
- **Plugin:** iChart – Easy Charts and Graphs (`ichart`), https://wordpress.org/plugins/ichart/
- **Affected versions:** from 2.1.8 before 2.2.4
- **Fixed in:** 2.2.4 (Update to 2.2.4 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-918
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ichart
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2393/

## Description

The iChart plugin for WordPress is vulnerable to Server-Side Request Forgery via the qcld_ai_fetch_raw_csv AJAX action in versions 2.1.8 up to, and including, 2.2.3. This is due to a user-supplied URL being passed to wp_remote_get without validation, with the action registered for unauthenticated users and protected only by a nonce printed on the front end. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and read data from internal services. The response is returned as parsed CSV rows.

## References

- https://wpsec.com/vuln/WPSEC-2026-2393/
- https://plugins.svn.wordpress.org/ichart/tags/2.2.4/
- https://wordpress.org/plugins/ichart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2393/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.