ICHART · CVE-2026-121998 · Package
NO FIX YET · SEE WHAT TO DO
The iChart WordPress plugin before 2.2.4 skips capability and ownership checks in several AJAX actions, so any logged-in user, including a Subscriber, can pass the nonce and act on that path. An attacker can read, change or permanently delete arbitrary posts and overwrite a site-wide option.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any WordPress site running the iChart plugin below 2.2.4 with user registration or any logged-in low-privilege accounts is exposed, because the AJAX actions accept any logged-in user. Sites where the plugin is absent or where only administrators can log in can skip it.
Not affected if no-logged-in-users, plugin-not-installed
Who cares ichart, wordpress
wp-content/plugins/ (look for the plugin header version).2.2.4 (fixed in versions before 2.2.4 per the advisory range; move to 2.2.4 or later).The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX actions, relying only on a nonce that any logged-in user can obtain, allowing users with a role as low as Subscriber to read, modify and permanently delete arbitrary posts and to overwrite a site-wide option.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.