PT-2025-41227 · WordPress · Chartify – Wordpress Chart Plugin

Avraham Shemesh + 1 · Published 2025-10-08 · Updated 2025-10-08 · CVE-2025-11171

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chartify – WordPress Chart Plugin versions prior to 3.5.9

Description The software contains a missing authentication check for a critical function. An unauthenticated AJAX action is registered, dispatching to admin-class methods based on a request parameter without proper security checks. This allows attackers to potentially execute administrative functions via the wp-admin/admin-ajax.php endpoint if they can determine callable method names.

Recommendations Update Chartify – WordPress Chart Plugin to version 3.5.9 or later.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-11171

Affected Products

Chartify – Wordpress Chart Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-11171 · Security Note
• https://plugins.trac.wordpress.org/browser/chart-builder/tags/3.5.8/includes/class-chart-builder.php#L247 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/aa3e030b-8ef1-4dbc-940d-6c2ab2683620?source=cve · Note
• https://t.me/CVEtracker/34413 · Telegram Post
• https://twitter.com/CVEnew/status/1975809103592034724 · Twitter Post
• https://plugins.trac.wordpress.org/browser/chart-builder/tags/3.5.8/admin/class-chart-builder-admin.php#L1625 · Note
• https://t.me/cveNotify/137766 · Telegram Post
• https://plugins.trac.wordpress.org/browser/chart-builder/tags/3.5.8/admin/class-chart-builder-admin.php#L675 · Note
• https://twitter.com/VulmonFeeds/status/1975875183970824372 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3372188%40chart-builder%2Ftags%2F3.6.0&new=3372188%40chart-builder%2Ftags%2F3.6.0 · Note