{
 "id": "WPSEC-2026-2394",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2394/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2394/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2394/index.md",
 "title": "iChart – Easy Charts and Graphs <= 2.2.3 - Authenticated (Subscriber+) Missing Authorization to AI Chart Generation and AI Analyst Execution",
 "description": "The iChart plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the qcld_ai_generate_chart_callback, qcld_ai_fix_json_callback, qcld_ai_generate_d3_code_callback and qcld_ai_analyst_run_callback functions in versions 2.1.8 up to, and including, 2.2.3. These handlers are protected only by a nonce that the front end exposes to any visitor. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make AI API calls billed to the site's credentials, overwrite the stored AI Analyst system prompt option, and make the server request arbitrary URLs through the AI Analyst 'csv_url' parameter.",
 "plugin": {
  "slug": "ichart",
  "name": "iChart – Easy Charts and Graphs",
  "full_name": "iChart – Easy Charts and Graphs",
  "wordpress_org": "https://wordpress.org/plugins/ichart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ichart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ichart"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.1.8",
    "from_inclusive": true,
    "to": "2.2.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.1.8 before 2.2.4"
  ]
 },
 "introduced_in": "2.1.8",
 "fixed_in": "2.2.4",
 "remediation": "Update to 2.2.4 or later.",
 "fix_released": "2026-11-02T14:40:14+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:23:09.601938+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2394/",
  "https://plugins.svn.wordpress.org/ichart/tags/2.2.4/",
  "https://wordpress.org/plugins/ichart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ichart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}