snailsploit/cve-2025-11171CVE-2025-11171
CVE-2025-11171: Missing Authentication in Chartify WordPress Plugin
Keywords: CVE-2025-11171, Chartify WordPress vulnerability, missing authentication, WordPress security, unauthenticated AJAX exploit, WordPress plugin vulnerability, CWE-306, WordPress chart plugin security, authentication bypass, WordPress CVE 2025
Chartify WordPress Plugin Authentication Bypass Vulnerability (CVE-2025-11171) - Critical security flaw allowing unauthenticated access to administrative functions in WordPress chart building plugin.
A critical authentication bypass vulnerability was discovered in the Chartify WordPress Chart Plugin that allows unauthenticated attackers to execute administrative functions.
Discovered by: Kai Aizen & Avraham Shemesh (SnailSploit)
Published: October 7, 2025
CVSS Score: 5.3 (Medium)
CWE: CWE-306 - Missing Authentication for Critical Function
Plugin: Chartify – WordPress Chart Plugin
Attack Type: Unauthenticated AJAX Admin Function Execution
Required Privileges: None (Unauthenticated Attack)
The Chartify WordPress Chart Plugin contains a missing authentication vulnerability in all versions up to and including 3.5.9. The plugin registers an unauthenticated AJAX action that dispatches to admin-class methods based on a request parameter without any nonce or capability checks.
This vulnerability allows unauthenticated attackers to:
wp-admin/admin-ajax.php endpointCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
| Metric | Value |
|---|---|
| Attack Vector | Network (AV:N) |
| Attack Complexity | Low (AC:L) |
| Privileges Required | None (PR:N) |
| User Interaction | None (UI:N) |
| Scope | Unchanged (S:U) |
| Confidentiality | None (C:N) |
| Integrity | Low (I:L) |
| Availability | None (A:N) |
The vulnerability exists in the AJAX handler implementation where:
POST /wp-admin/admin-ajax.php
The vulnerability can be exploited through the WordPress admin-ajax.php endpoint without authentication, provided the attacker can identify valid method names.
Immediate Action Required:
admin-ajax.phpEnsure all AJAX handlers implement proper security controls:
// Example of proper AJAX security
add_action('wp_ajax_your_action', 'your_callback');
function your_callback() {
// Verify nonce
check_ajax_referer('your_nonce_action', 'nonce');
// Check capabilities
if (!current_user_can('manage_options')) {
wp_die('Unauthorized');
}
// Your secure code here
}
Researchers:
Disclosure Process: Coordinated through Wordfence Bug Bounty Program
This information is provided for security research and defensive purposes only. Any exploitation of this vulnerability for malicious purposes is illegal and unethical. Always obtain proper authorization before testing systems you do not own.
For questions or additional information about this vulnerability:
Last updated: October 13, 2025
This project's full writeup, methodology, and related research lives at:
Created by Kai Aizen — independent offensive security researcher.
snailsploit.com · Research · Frameworks · GitHub · LinkedIn · ResearchGate · X/Twitter
Same attack. Different substrate.