CVE-2025-11171

Name of the Vulnerable Software and Affected Versions Chartify – WordPress Chart Plugin versions prior to 3.5.9

Description The software contains a missing authentication check for a critical function. An unauthenticated AJAX action is registered, dispatching to admin-class methods based on a request parameter without proper security checks. This allows attackers to potentially execute administrative functions via the wp-admin/admin-ajax.php endpoint if they can determine callable method names.

Recommendations Update Chartify – WordPress Chart Plugin to version 3.5.9 or later.