# M Chart <= 2.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Chart Data Disclosure

- **ID:** WPSEC-2026-3125
- **Plugin:** M Chart (`m-chart`), https://wordpress.org/plugins/m-chart/
- **Affected versions:** all versions before 2.4.1
- **Fixed in:** 2.4.1 (Update to 2.4.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/m-chart
- **Fix released:** 2026-11-13
- **Published:** 2026-11-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3125/

## Description

The M Chart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4. On the Add Chart screen, the chart editor takes the chart ID from the 'post' query parameter and never checks that the current user can edit that chart. This makes it possible for authenticated attackers, with Contributor-level access and above, to load the settings and spreadsheet data of charts that belong to other users, including draft, private and password-protected charts, into the editor configuration.

## References

- https://wpsec.com/vuln/WPSEC-2026-3125/
- https://plugins.svn.wordpress.org/m-chart/tags/2.4.1/
- https://wordpress.org/plugins/m-chart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3125/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.