Graphina CVE-2026-65529

No authentication is required - the CVSS vector PR:N/AV:N confirms unauthenticated network exploitation. The target WordPress site must have the Graphina Elementor Charts and Graphs plugin installed and activated at version 3.1.12 or earlier. Standard WordPress network accessibility (port 80/443) is the only prerequisite. Exploitation is limited to confidentiality impact (C:L); the attacker cannot modify data (I:N) or affect availability (A:N). Sites using Graphina exclusively to display non-sensitive, publicly intended data face negligible practical impact despite the access control bypass being present. No specific non-default configuration is required - the vulnerable endpoint is expected to be present in any standard installation of the affected version.

The provided CVSS 3.1 score of 5.3 (Medium) is appropriate given the AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector: exploitability is high (unauthenticated, low complexity, remote), but impact is deliberately constrained to limited confidentiality with no integrity or availability consequence. This pattern is typical of information-disclosure flavors of broken access control, where an attacker can read data they should not see but cannot modify or destroy anything. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been identified, reducing urgency relative to a KEV-listed or PoC-accompanied finding. Real-world risk is primarily relevant to WordPress deployments that use Graphina to display sensitive or proprietary data in charts, where unauthorized read access could expose business intelligence or PII. For sites using Graphina purely with public data, the practical impact may be negligible. SSVC exploitation status is classified as 'none' given absence of public exploit or active exploitation reports, though the low exploitation complexity means that could change rapidly if a PoC emerges.

An unauthenticated attacker identifies a WordPress site running Graphina <= 3.1.12 and sends a crafted HTTP POST or GET request to the publicly accessible WordPress AJAX handler (wp-admin/admin-ajax.php) or a REST API route registered by the plugin. Because no authorization check is performed, the server returns data or performs an action that should require authentication, exposing restricted chart data or plugin configuration. No public exploit code has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector means exploitation requires only knowledge of the endpoint name.