{
 "id": "WPSEC-2026-2395",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2395/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2395/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2395/index.md",
 "title": "iChart – Easy Charts and Graphs <= 2.2.3 - Missing Authorization to Unauthenticated Dashboard Creation/Modification and CSV File Upload",
 "description": "The iChart plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the qcld_save_dashboard_callback and qcld_ai_upload_csv_callback AJAX functions in versions 2.1.8 up to, and including, 2.2.3. Both handlers are registered for unauthenticated users and rely only on a nonce that the front-end dashboard shortcodes print for every visitor. This makes it possible for unauthenticated attackers to create published dashboard posts, set their data source URL and scheduled refresh, and upload CSV files into the site's media library.",
 "plugin": {
  "slug": "ichart",
  "name": "iChart – Easy Charts and Graphs",
  "full_name": "iChart – Easy Charts and Graphs",
  "wordpress_org": "https://wordpress.org/plugins/ichart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ichart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ichart"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.1.8",
    "from_inclusive": true,
    "to": "2.2.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.1.8 before 2.2.4"
  ]
 },
 "introduced_in": "2.1.8",
 "fixed_in": "2.2.4",
 "remediation": "Update to 2.2.4 or later.",
 "fix_released": "2026-11-02T14:40:14+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:23:09.601938+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2395/",
  "https://plugins.svn.wordpress.org/ichart/tags/2.2.4/",
  "https://wordpress.org/plugins/ichart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ichart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}