CVE-2025-23961 Overview
CVE-2025-23961 is a missing authorization vulnerability [CWE-862] in the wptasker WordPress Graphs & Charts plugin (graph-lite). The flaw affects all versions up to and including 2.0.8. Authenticated attackers with low-privilege accounts can exploit incorrectly configured access control checks to perform actions restricted to higher-privileged users. The vulnerability produces limited impact on integrity and availability but does not expose confidential data.
Critical Impact
Authenticated users with low privileges can bypass access control checks in the WordPress Graphs & Charts plugin, allowing unauthorized modification of plugin-managed data on affected WordPress sites.
Affected Products
- WordPress Graphs & Charts plugin (graph-lite) by wptasker
- All versions from initial release through 2.0.8
- WordPress installations with the vulnerable plugin activated
Discovery Timeline
- 2025-01-16 - CVE-2025-23961 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-23961
Vulnerability Analysis
The vulnerability stems from missing authorization checks on one or more plugin endpoints. WordPress plugins commonly expose AJAX handlers and REST API routes that require capability verification through functions such as current_user_can() or nonce validation via check_ajax_referer(). The graph-lite plugin omits or improperly implements these checks on privileged actions.
An attacker authenticated with a low-privilege role, such as Subscriber, can invoke these actions. The plugin processes the request without verifying that the caller holds the required capability. This constitutes a broken access control condition mapped to [CWE-862].
Root Cause
The root cause is the absence of server-side authorization enforcement on plugin actions. Access control decisions rely on incorrectly configured checks that do not validate the calling user's role or capability. The Patchstack advisory classifies this as a broken access control vulnerability affecting all versions through 2.0.8.
Attack Vector
Exploitation requires network access to the WordPress site and a valid authenticated session with any low-privilege role. No user interaction from an administrator is required. The attacker sends crafted HTTP requests to the vulnerable plugin endpoints. Successful exploitation allows limited modification of plugin state and can cause minor availability disruption to graph and chart functionality. See the Patchstack Vulnerability Report for technical references.
Detection Methods for CVE-2025-23961
Indicators of Compromise
- Unexpected modifications to graph or chart content created by low-privilege user accounts
- HTTP POST requests to graph-lite plugin AJAX endpoints (/wp-admin/admin-ajax.php) or REST routes from non-administrator sessions
- Anomalous activity from Subscriber or Contributor accounts targeting plugin actions
Detection Strategies
- Audit WordPress access logs for requests referencing the graph-lite plugin path or its AJAX actions from low-privilege users
- Review the plugin version installed across WordPress sites and flag any instance running version 2.0.8 or earlier
- Correlate plugin-related database changes with the user_id of the account that initiated them
Monitoring Recommendations
- Enable WordPress audit logging to record capability checks, role changes, and plugin data modifications
- Monitor for spikes in authenticated requests to admin-ajax.php with plugin-specific action parameters
- Alert on new user registrations followed by immediate access to plugin endpoints
How to Mitigate CVE-2025-23961
Immediate Actions Required
- Inventory all WordPress sites using the graph-lite plugin and identify installations at version 2.0.8 or earlier
- Update the plugin to a patched release once available from wptasker; if no patched version exists, deactivate and remove the plugin
- Restrict user registration on WordPress sites that do not require self-service accounts
Patch Information
At the time of publication, the Patchstack advisory lists affected versions as n/a through <= 2.0.8. Administrators should consult the Patchstack Vulnerability Report and the WordPress plugin repository for the latest fixed version.
Workarounds
- Deactivate the graph-lite plugin until a fixed version is installed
- Use a Web Application Firewall (WAF) rule to block requests to plugin endpoints from non-administrator sessions
- Enforce least-privilege role assignment and disable open user registration where feasible
# Disable the vulnerable plugin via WP-CLI until a patch is applied
wp plugin deactivate graph-lite
wp plugin list --name=graph-lite --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
