AJAX Actions Vulnerability in iChart WordPress Plugin by iChart
CVE-2026-121998
Key Information:
Badges
What is CVE-2026-121998?
The iChart WordPress plugin prior to version 2.2.4 contains a vulnerability that permits logged-in users, even those with minimal permissions such as Subscribers, to execute unauthorized actions. The plugin fails to implement proper capability or ownership checks for multiple AJAX actions, relying solely on a nonce that is easily accessible by any authenticated user. This weakness enables attackers to read, modify, and permanently delete arbitrary posts, as well as to overwrite essential site-wide options, leading to potential full site compromise.
Affected Version(s)
iChart 0 < 2.2.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.