Graphina
Monthly
Unauthenticated broken authentication in the Graphina - Elementor Charts and Graphs WordPress plugin affects versions 3.1.12 and earlier, allowing network-reachable attackers to reach functionality that should require authentication and, per the assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), to obtain high-impact confidential information without any credentials or user interaction. Because the vector carries PR:N, exploitation requires no authentication and no special conditions beyond the plugin being installed, active, and at a vulnerable version - in practice this means a site running Elementor with the affected Graphina release. Only confidentiality is impacted; there is no integrity or availability effect per the assessed vector, and no public exploit code or CISA KEV entry was identified in the available intelligence, so no public exploit is identified at time of analysis. The precise vulnerable feature or endpoint is not described in the supplied data and should be confirmed against the Patchstack advisory.
Broken Access Control in the Graphina Elementor Charts and Graphs WordPress plugin (versions up to and including 3.1.12) allows unauthenticated remote attackers to access restricted functionality or data without proper authorization. The flaw stems from missing authorization checks (CWE-862), meaning certain plugin endpoints or AJAX actions fail to verify whether the requesting user holds the necessary permissions before serving a response. Impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated broken authentication in the Graphina - Elementor Charts and Graphs WordPress plugin affects versions 3.1.12 and earlier, allowing network-reachable attackers to reach functionality that should require authentication and, per the assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), to obtain high-impact confidential information without any credentials or user interaction. Because the vector carries PR:N, exploitation requires no authentication and no special conditions beyond the plugin being installed, active, and at a vulnerable version - in practice this means a site running Elementor with the affected Graphina release. Only confidentiality is impacted; there is no integrity or availability effect per the assessed vector, and no public exploit code or CISA KEV entry was identified in the available intelligence, so no public exploit is identified at time of analysis. The precise vulnerable feature or endpoint is not described in the supplied data and should be confirmed against the Patchstack advisory.
Broken Access Control in the Graphina Elementor Charts and Graphs WordPress plugin (versions up to and including 3.1.12) allows unauthenticated remote attackers to access restricted functionality or data without proper authorization. The flaw stems from missing authorization checks (CWE-862), meaning certain plugin endpoints or AJAX actions fail to verify whether the requesting user holds the necessary permissions before serving a response. Impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis.