Skip to content
OpenAdvisories
Medium · 5.3 Public exploit CVE-2025-11171 EUVD-2025-31849GHSA-8wvg-5x7g-q897

Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function

Published Oct 8, 2025 · Updated Apr 8, 2026 · Assigned by Wordfence

Vendor: Ays Pro Product: Chartify – WordPress Chart Plugin Category: Web / CMS

Description

The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9. This is due to the plugin registering an unauthenticated AJAX action that dispatches to admin-class methods based on a request parameter, without any nonce or capability checks. This makes it possible for unauthenticated attackers to execute administrative functions via the wp-admin/admin-ajax.php endpoint granted they can identify callable method names.

Affected products

VendorProductAffectedFixed
ays-pro Chartify – WordPress Chart Plugin ≤ 3.5.9 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References