Chartify CVE-2025-11171

Exploitation requires that the Chartify (chart-builder) plugin version 3.5.9 or earlier be installed and active on a reachable WordPress site, and that the attacker can identify a valid administrative method name dispatched by the plugin's unauthenticated AJAX action via the request parameter at wp-admin/admin-ajax.php. No authentication, nonce, capability, or user interaction is needed (PR:N/UI:N), and default configurations are affected. The primary limiting factor is the need to know or enumerate callable admin-class method names - the handler dispatches by request parameter, so impact is bounded by which methods are reachable and what each does; the publicly accessible plugin source on plugins.trac.wordpress.org makes such enumeration feasible.

This is a genuine but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:L/A:N, score 5.3 MEDIUM) describes a network-reachable, unauthenticated flaw with only a LOW integrity impact and no confidentiality or availability impact - consistent with CWE-306 (Missing Authentication for Critical Function). Exploitation signals are modest: EPSS is 0.41% (33rd percentile), there is no CISA KEV listing, and no public exploit code is referenced, so exploitation is neither confirmed nor broadly likely. One tension worth noting: the description qualifies exploitation with 'granted they can identify callable method names,' which is a real practical hurdle the CVSS AC:L rating does not reflect - an attacker must enumerate or know valid admin-class method names dispatched through the unauthenticated AJAX handler, and the actual severity depends entirely on which methods are reachable (the scored I:L assumes limited integrity impact, but a dangerous callable method could realistically push impact higher). No SSVC decision data was provided in the input. Overall: a real, patch-worthy vulnerability driven by the unauthenticated-access design flaw, but current evidence points to opportunistic rather than mass or active exploitation.

An unauthenticated attacker identifies a valid admin-class method name exposed by Chartify's AJAX dispatcher and sends a crafted POST request to wp-admin/admin-ajax.php specifying that method, with no nonce or capability check blocking the call. Because the vector is fully remote and requires no authentication or user interaction (AV:N/PR:N/UI:N), the request is processed and an administrative function executes. No public exploit code was identified at time of analysis, so this remains a theoretical-but-straightforward attack path.