EUVD-2026-93276
GHSA-xv58-2hqp-prfg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site over network
-
ExploitSend request to Graphina plugin endpoint
-
ExecutionBypass broken authentication check
-
ImpactDisclose protected information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | No special conditions beyond running the affected software - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote unauthenticated exploitation of the Graphina (Graphina - Elementor Charts and Graphs) WordPress plugin at version 3.1.12 or earlier. The primary limiting factor is deployment scope: the site must have this specific plugin installed and active at a vulnerable version, and (per Elementor dependency) typically requires the Elementor page builder. Impact is confined to confidentiality/information disclosure; no integrity or availability effect applies. The exact vulnerable feature or endpoint is not detailed in the provided data and should be confirmed from the Patchstack advisory. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated broken-authentication flaw (CWE-288) with high confidentiality impact and no integrity or availability impact - consistent with the 'Information Disclosure' tag and the vendor's 'Broken Authentication' classification. No EPSS probability, CISA KEV listing, or SSVC decision data was supplied, and no public exploit is referenced, so active-exploitation and automatability signals cannot be evaluated from the provided data. The combination of unauthenticated network access and low complexity makes this an easy-to-trigger issue, but the real-world priority is tempered because impact is limited to information disclosure (no data modification or service disruption) and the affected software is a single third-party WordPress plugin rather than a core platform. Net assessment: a genuine, straightforwardly exploitable confidentiality issue worth patching promptly, but absent KEV/EPSS/POC evidence it should be treated as elevated-but-not-emergency rather than confirmed widespread exploitation. Note the signals are internally consistent - no CVSS-vs-description conflict was detected. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a WordPress site running Graphina <= 3.1.12, abusing an authentication-bypass flaw (CWE-288) in the plugin to reach functionality or data that should require authentication. This yields unauthorized disclosure of sensitive information (C:H) without any user interaction or credentials. No public proof-of-concept exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated broken authentication in the Graphina - Elementor Charts and Graphs WordPress plugin affects versions 3.1.12 and earlier, allowing network-reachable attackers to reach functionality that should require authentication and, per the assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), to obtain high-impact confidential information without any credentials or user interaction. Because the vector carries PR:N, exploitation requires no authentication and no special conditions beyond the plugin being installed, active, and at a vulnerable version - in practice this means a site running Elementor with the affected Graphina release. Only confidentiality is impacted; there is no integrity or availability effect per the assessed vector, and no public exploit code or CISA KEV entry was identified in the available intelligence, so no public exploit is identified at time of analysis. The precise vulnerable feature or endpoint is not described in the supplied data and should be confirmed against the Patchstack advisory.
RemediationAI
No vendor-released patched version is identified in the available data; the sole reference is the Patchstack advisory for the 3.1.12 broken-authentication issue (https://patchstack.com/database/wordpress/plugin/graphina-elementor-charts-and-graphs/vulnerability/wordpress-graphina-plugin-3-1-12-broken-authentication-vulnerability), which should be checked for a fixed release and for the specific vulnerable endpoint before relying on any upgrade. Until a patched build is confirmed, apply compensating controls: deactivate and remove Graphina on sites that do not actively use its charts, which eliminates exposure entirely but removes chart and graph functionality from Elementor pages; if the plugin must remain, place the site behind an edge WAF or reverse proxy rule set that blocks or challenges unauthenticated requests to Graphina-specific paths, AJAX actions, and REST namespaces, accepting the trade-off that legitimate unauthenticated rendering or public-facing chart endpoints may break and that generic rules may produce false positives; restrict access to administrative, AJAX (admin-ajax.php with plugin-specific actions), and REST routes to trusted networks or authenticated sessions where operationally feasible, noting this will also affect any legitimate anonymous chart consumers. Additionally, because the impact is information disclosure, review the plugin's stored chart configurations and datasets for sensitive content that should not be publicly reachable, and monitor logs for unusual unauthenticated requests to Graphina endpoints as a detection measure while patch status remains unconfirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Graphina is a third-party charting and graphing add-on for the Elementor page builder, distributed through the WordPress plugin ecosystem and maintained by Iqonic Design (CPE: cpe:2.3:a:iqonic_design:graphina:*:*:*:*:*:*:*:*). The root cause class is CWE-288, Authentication Bypass Using an Alternate Path or Channel: a request handler, AJAX action, REST route, or shortcode-rendered endpoint is reachable through a code path that does not enforce the authentication or capability checks that the intended path applies, so an unauthenticated visitor can invoke it. Under the WordPress execution model this typically means a registered action or REST callback that either omits a current_user_can() / nonce-and-capability gate or checks the wrong condition, allowing direct requests to return protected data. The CVSS vector's PR:N with UI:N confirms the flaw is exploitable over the network by an unauthenticated actor with no user interaction, and the C:H/I:N/A:N profile indicates the disclosed result is confidential data (for example chart configuration, stored datasets, or other plugin-managed content) rather than modification or denial of service. Deployment scope is the practical limiter: the plugin must be present and active at a vulnerable version, and because Graphina is an Elementor extension, Elementor is generally also required on the site.
Know when Graphina gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Authentication bypass (CWE-288) is remotely reachable with no credentials or interaction, hence AV:N/AC:L/PR:N/UI:N; impact is information disclosure only, so C:H, I:N, A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Authentication in Graphina <= 3.1.12 versions.
Executive ViewAI
CVE-2026-39769 is a high-severity unauthenticated authentication bypass in the Graphina - Elementor Charts and Graphs WordPress plugin (versions 3.1.12 and earlier) that allows any network-reachable party to reach functionality intended to require authentication and read high-impact confidential information without credentials or user interaction. Any public-facing website running Elementor with a vulnerable Graphina release is exposed, and because no vendor patch has been released, exposure persists until the plugin is removed, disabled, or otherwise mitigated. Leadership should care because the flaw is remotely reachable with no authentication barrier, hits only data confidentiality, and the business cannot rely on a vendor fix to close it on a known timeline.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall the Graphina - Elementor Charts and Graphs plugin on any site running version 3.1.12 or earlier where chart functionality is not essential; where it must remain active, apply WAF or reverse-proxy rules to block unauthenticated access to plugin endpoints and virtual-patch the authentication bypass; restrict network reachability of affected sites to trusted ranges where operationally feasible; and enable and monitor web/application logging for anomalous data access until a vendor fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB