iChart – Easy Charts and Graphs <= 2.2.3 - Authenticated (Subscriber+) Missing Authorization to AI Chart Generation and AI Analyst Execution
- ID
- WPSEC-2026-2394
- Plugin
- iChart – Easy Charts and Graphs (ichart)
- Affected
- from 2.1.8 before 2.2.4
- Remediation
- Update to 2.2.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- iChart – Easy Charts and Graphs on WPSec AttackSurface
- Fix released
- Published
Description
The iChart plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the qcld_ai_generate_chart_callback, qcld_ai_fix_json_callback, qcld_ai_generate_d3_code_callback and qcld_ai_analyst_run_callback functions in versions 2.1.8 up to, and including, 2.2.3. These handlers are protected only by a nonce that the front end exposes to any visitor. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make AI API calls billed to the site's credentials, overwrite the stored AI Analyst system prompt option, and make the server request arbitrary URLs through the AI Analyst 'csv_url' parameter.
References
- https://wpsec.com/vuln/WPSEC-2026-2394/
- https://plugins.svn.wordpress.org/ichart/tags/2.2.4/
- https://wordpress.org/plugins/ichart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS