M Chart <= 2.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Chart Data Disclosure

ID

WPSEC-2026-3125

Plugin

M Chart (m-chart)

Affected

all versions before 2.4.1

Remediation

Update to 2.4.1 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness

CWE-639

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-14

Attack surface

M Chart on WPSec AttackSurface

Fix released

2026-11-13

Published

2026-11-14

Description

The M Chart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4. On the Add Chart screen, the chart editor takes the chart ID from the 'post' query parameter and never checks that the current user can edit that chart. This makes it possible for authenticated attackers, with Contributor-level access and above, to load the settings and spreadsheet data of charts that belong to other users, including draft, private and password-protected charts, into the editor configuration.

References

• https://wpsec.com/vuln/WPSEC-2026-3125/
• https://plugins.svn.wordpress.org/m-chart/tags/2.4.1/
• https://wordpress.org/plugins/m-chart/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS