CVE-2025-11171: Chartify WordPress Auth Bypass Vulnerability

CVE-2025-11171 Overview

CVE-2025-11171 affects the Chartify – WordPress Chart Plugin (also known as Chart Builder) in all versions up to and including 3.5.9. The plugin registers an unauthenticated AJAX action that dispatches to admin-class methods based on a request parameter. No nonce validation or capability check protects the dispatcher. Unauthenticated attackers can invoke administrative functions through the wp-admin/admin-ajax.php endpoint if they know or can enumerate callable method names. The issue is tracked as Missing Authentication for Critical Function [CWE-306].

Critical Impact
Unauthenticated remote attackers can trigger administrative plugin functions on any WordPress site running Chartify <= 3.5.9, exposing site data and integrity depending on which internal methods they reach.

Affected Products

Chartify – WordPress Chart Plugin (Chart Builder) versions <= 3.5.9
WordPress sites with the plugin activated
Fixed in Chart Builder version 3.6.0

Discovery Timeline

2025-10-08 - CVE-2025-11171 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11171

Vulnerability Analysis

The Chartify plugin registers an AJAX handler that is reachable by both authenticated and unauthenticated users through the standard wp-admin/admin-ajax.php interface. The handler acts as a generic dispatcher: it reads a method-name parameter from the incoming request and calls the corresponding method on an admin-side class. WordPress requires developers to add explicit check_ajax_referer() nonce validation and current_user_can() capability checks inside such handlers. Chartify performs neither. As a result, any function exposed by the admin controller becomes callable from the public internet without authentication. The dispatcher pattern also expands attack surface, because every administrative helper method added to the class becomes reachable through the same entry point.

Root Cause

The root cause is the registration of a wp_ajax_nopriv_ action bound to a dispatcher that trusts client-supplied input to select the target method. The handler omits nonce verification, capability checks, and any allow-list of safe callable names. Missing authentication on a privileged code path maps directly to [CWE-306].

Attack Vector

An attacker sends an HTTP POST request to wp-admin/admin-ajax.php with the plugin's action parameter and a method-name parameter identifying an admin-class function. The plugin invokes the method server-side without verifying the caller. Method names can be enumerated from the plugin source, which is publicly available on the WordPress plugin repository. See the WordPress Chart Builder Code Review and Wordfence Vulnerability Analysis for technical details on the vulnerable dispatcher.

Detection Methods for CVE-2025-11171

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing the Chartify AJAX action with a method-name parameter.
Unexpected creation, modification, or deletion of chart records, plugin options, or uploaded files tied to the Chart Builder plugin.
Access-log spikes to admin-ajax.php from single source IP addresses without an accompanying authenticated session cookie.

Detection Strategies

Inspect web server logs for requests to admin-ajax.php with the Chartify action parameter originating from unauthenticated clients.
Alert on any successful HTTP 200 responses to admin-ajax.php where the request lacks a valid wordpress_logged_in_* cookie yet targets the plugin.
Compare installed plugin versions against 3.6.0 across the WordPress fleet and flag hosts running <= 3.5.9.

Monitoring Recommendations

Enable verbose logging on WordPress AJAX endpoints and forward events to a centralized log platform.
Baseline normal request rates to admin-ajax.php and alert on deviations from unauthenticated sources.
Track file integrity of the chart-builder plugin directory and any output directories it writes to.

How to Mitigate CVE-2025-11171

Immediate Actions Required

Update the Chartify – WordPress Chart Plugin to version 3.6.0 or later on all WordPress installations.
If immediate patching is not possible, deactivate and remove the plugin until the upgrade can be applied.
Review WordPress logs for prior exploitation attempts against admin-ajax.php and audit plugin data for tampering.

Patch Information

The vendor released Chart Builder 3.6.0 to address the missing authentication check. See the WordPress Chart Builder Changeset for the code changes that add authorization checks to the affected AJAX dispatcher.

Workarounds

Block unauthenticated access to wp-admin/admin-ajax.php requests carrying the Chartify action parameter using a Web Application Firewall (WAF) rule.
Restrict /wp-admin/ access to trusted source IP ranges at the reverse proxy or WAF layer.
Remove the plugin entirely from sites that do not require chart-rendering functionality.

bash

# Example WAF rule concept - block unauthenticated Chartify AJAX calls
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1011171,msg:'CVE-2025-11171 Chartify unauth AJAX'"
  SecRule ARGS:action "@rx ^(chart[-_]builder|chartify)" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"