CVE-2025-11171mediumCWE-306

CVE-2025-11171: medium-severity vulnerability in ays-pro Chartify – WordPress Chart Plugin

Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function

Published · Updated

Follow this CVE+ Monitor Chartify – WordPress Chart Plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9. This is due to the plugin registering an unauthenticated AJAX action that dispatches to admin-class methods based on a request parameter, without any nonce or capability checks. This makes it possible for unauthenticated attackers to execute administrative functions via the wp-admin/admin-ajax.php endpoint granted they can identify callable method names.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
ays-pro · Chartify – WordPress Chart Plugin
Related CVEs — ays-pro Chartify – WordPress Chart Plugin

In the same product, most dangerous first.

CVE-2024-10571CRITICALChartify – WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via sourceEPSS 4.8%