Vulnerabilities / iChart – Easy Charts and Graphs / WPSEC-2026-2395
iChart – Easy Charts and Graphs <= 2.2.3 - Missing Authorization to Unauthenticated Dashboard Creation/Modification and CSV File Upload
Medium 5.3
CWE-862Fixed in 2.2.4
- ID
- WPSEC-2026-2395
- Plugin
- iChart – Easy Charts and Graphs (ichart)
- Affected
- from 2.1.8 before 2.2.4
- Remediation
- Update to 2.2.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- iChart – Easy Charts and Graphs on WPSec AttackSurface
- Fix released
- Published
Description
The iChart plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the qcld_save_dashboard_callback and qcld_ai_upload_csv_callback AJAX functions in versions 2.1.8 up to, and including, 2.2.3. Both handlers are registered for unauthenticated users and rely only on a nonce that the front-end dashboard shortcodes print for every visitor. This makes it possible for unauthenticated attackers to create published dashboard posts, set their data source URL and scheduled refresh, and upload CSV files into the site's media library.
References
- https://wpsec.com/vuln/WPSEC-2026-2395/
- https://plugins.svn.wordpress.org/ichart/tags/2.2.4/
- https://wordpress.org/plugins/ichart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS