CVE-2025-54673: Chartify Chart-Builder CSRF Vulnerability

CVE-2025-54673 Overview

CVE-2025-54673 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Ays Pro Chartify (chart-builder) plugin for WordPress. The flaw exists in all plugin versions up to and including 3.5.3. An unauthenticated attacker can craft a malicious web page that triggers state-changing requests against the plugin when an authenticated administrator visits it. Successful exploitation requires user interaction, and the impact is limited to integrity of plugin data. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker can trick an authenticated WordPress administrator into performing unintended plugin actions, resulting in unauthorized modification of Chartify data or configuration.

Affected Products

Ays Pro Chartify (chart-builder) WordPress plugin — all versions through 3.5.3
WordPress sites running the vulnerable Chartify plugin
Administrator accounts with sessions active on affected WordPress installations

Discovery Timeline

2025-08-14 - CVE-2025-54673 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54673

Vulnerability Analysis

The Chartify plugin exposes state-changing endpoints that do not validate the origin of incoming requests. The plugin fails to enforce anti-CSRF tokens (WordPress nonces) or verify the Referer/Origin headers before executing privileged actions. An attacker who lures an authenticated administrator to a malicious page can force the browser to submit forged requests using the victim's active session cookies. Because the vulnerability relies on the victim's authenticated context, no attacker-side credentials are required. The impact is scoped to integrity: attackers can create, modify, or delete chart-builder data through actions the administrator is authorized to perform.

Root Cause

The root cause is missing or improperly validated CSRF protection on plugin request handlers. WordPress provides wp_nonce_field() and check_admin_referer() / wp_verify_nonce() primitives for CSRF defense, but the affected Chartify handlers do not consistently invoke these checks before mutating state. This omission maps directly to CWE-352.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a page containing a hidden form or JavaScript that auto-submits a request to the target WordPress site's Chartify endpoint. When an authenticated administrator visits the page, the browser attaches the WordPress session cookie and the request executes with administrator privileges. See the Patchstack CSRF Vulnerability Report for the disclosed advisory details.

No verified proof-of-concept code is publicly available. The vulnerability manifests when Chartify action handlers process incoming POST or GET requests without validating a WordPress nonce.

Detection Methods for CVE-2025-54673

Indicators of Compromise

Unexpected creation, modification, or deletion of Chartify charts or plugin settings without a corresponding administrator-initiated session action.
WordPress access logs showing POST requests to Chartify endpoints with external or suspicious Referer headers.
Administrator browser history containing visits to untrusted sites immediately preceding unauthorized plugin state changes.

Detection Strategies

Audit WordPress activity logs for state-changing Chartify actions and correlate with the originating Referer and IP address.
Inspect HTTP requests to plugin endpoints for missing or invalid _wpnonce parameters.
Compare current plugin configuration and chart data against known-good backups to identify unauthorized changes.

Monitoring Recommendations

Enable a WordPress audit-logging plugin to record administrative actions with request metadata.
Alert on requests to Chartify admin endpoints that originate from external referrers or lack expected nonce parameters.
Monitor administrator account behavior for actions performed outside normal working hours or from unusual geolocations.

How to Mitigate CVE-2025-54673

Immediate Actions Required

Update the Ays Pro Chartify (chart-builder) plugin to a version later than 3.5.3 as soon as a fixed release is available from the vendor.
Restrict WordPress administrator accounts from browsing untrusted websites in the same session used for site administration.
Review Chartify configuration and chart data for unauthorized modifications and restore from backup if tampering is detected.

Patch Information

Refer to the Patchstack advisory for the latest patch status. Versions through 3.5.3 are affected. Apply the vendor-supplied update once released, and verify the plugin version after upgrade.

Workarounds

Deactivate the Chartify plugin until a patched version is installed if it is not required for site operation.
Deploy a Web Application Firewall (WAF) rule that blocks requests to Chartify admin endpoints missing a valid _wpnonce parameter or carrying an external Referer.
Enforce administrator use of a dedicated browser or browser profile for WordPress management to reduce cross-site request exposure.
Require re-authentication for sensitive plugin actions by shortening WordPress session lifetimes.

bash

# Example WAF rule (ModSecurity) to block cross-origin POSTs to Chartify endpoints
SecRule REQUEST_URI "@rx /wp-admin/admin(-ajax|-post)\.php" \
  "chain,phase:2,deny,status:403,id:1005401,msg:'Blocked cross-origin request to Chartify endpoint'"
  SecRule ARGS:action "@rx (chartify|chart_builder|ays_chart)" \
    "chain"
    SecRule &ARGS:_wpnonce "@eq 0"