# iChart – Easy Charts and Graphs <= 2.2.3 - Authenticated (Subscriber+) Missing Authorization to AI Chart Generation and AI Analyst Execution

- **ID:** WPSEC-2026-2394
- **Plugin:** iChart – Easy Charts and Graphs (`ichart`), https://wordpress.org/plugins/ichart/
- **Affected versions:** from 2.1.8 before 2.2.4
- **Fixed in:** 2.2.4 (Update to 2.2.4 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ichart
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2394/

## Description

The iChart plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the qcld_ai_generate_chart_callback, qcld_ai_fix_json_callback, qcld_ai_generate_d3_code_callback and qcld_ai_analyst_run_callback functions in versions 2.1.8 up to, and including, 2.2.3. These handlers are protected only by a nonce that the front end exposes to any visitor. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make AI API calls billed to the site's credentials, overwrite the stored AI Analyst system prompt option, and make the server request arbitrary URLs through the AI Analyst 'csv_url' parameter.

## References

- https://wpsec.com/vuln/WPSEC-2026-2394/
- https://plugins.svn.wordpress.org/ichart/tags/2.2.4/
- https://wordpress.org/plugins/ichart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2394/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.