CVE-2025-11171: 
WordPress vulnerability analysis and mitigation

CVE-2025-11171 is a Missing Authentication for Critical Function vulnerability (CWE-306) in the Chartify – WordPress Chart Plugin. It affects all versions up to and including 3.5.9, allowing unauthenticated attackers to invoke administrative functions via the WordPress AJAX endpoint. The vulnerability was published on October 8, 2025, and reported by Wordfence. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Wordfence as the CNA (Wordfence).

The root cause is the plugin's registration of an unauthenticated AJAX action (CWE-306) that dispatches requests to admin-class methods based on a user-supplied request parameter, with no nonce verification or capability checks performed. Specifically, the vulnerable code in class-chart-builder.php (line 247) registers the AJAX hook, while class-chart-builder-admin.php (lines 675 and 1625) contains the callable admin methods that can be reached without authentication. An attacker can send crafted POST requests to wp-admin/admin-ajax.php specifying the target method name in a request parameter to trigger administrative operations. The attack requires no privileges or user interaction, only knowledge of valid callable method names (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated remote attackers to execute administrative plugin functions, primarily impacting integrity (CVSS integrity impact: Low). While confidentiality and availability are not directly impacted per the CVSS assessment, the ability to invoke admin-class methods without authentication could allow unauthorized modification of chart data, plugin settings, or other administrative state managed by the plugin. The scope is limited to WordPress sites running the affected plugin versions, and lateral movement beyond the plugin's administrative scope is not directly facilitated (Wordfence).

A GitHub repository referencing a security advisory for CVE-2025-11171 was published shortly after disclosure, suggesting public interest and potential PoC availability (GitHub SnailSploit). No confirmed in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.00146 (0.146%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Chartify – WordPress Chart Plugin (versions ≤ 3.5.9) using tools like WPScan, Shodan, or by inspecting plugin directories at /wp-content/plugins/chart-builder/.
2. Enumerate callable methods: Review the plugin source code (publicly available on the WordPress plugin repository) to identify admin-class method names registered via the unauthenticated AJAX action, particularly in class-chart-builder-admin.php at lines 675 and 1625.
3. Craft malicious AJAX request: Send an unauthenticated HTTP POST request to https://target-site.com/wp-admin/admin-ajax.php with the appropriate action parameter corresponding to the plugin's registered AJAX hook and a method (or equivalent) parameter specifying the target admin function.
4. Execute administrative function: The server dispatches the request to the specified admin-class method without any nonce or capability verification, executing the administrative operation (e.g., modifying plugin settings or chart data) (Wordfence, WordPress Trac).

• Network: Unusual unauthenticated POST requests to /wp-admin/admin-ajax.php from external IPs, particularly with action parameters associated with the Chartify plugin (e.g., chart_builder_* action names).
• Logs: WordPress access logs showing repeated POST requests to admin-ajax.php without a valid session cookie or nonce, originating from the same IP or user-agent.
• File System: Unexpected changes to chart plugin configuration files or database entries related to chart settings that do not correspond to authenticated admin activity.
• Application: Unexplained modifications to chart data or plugin settings visible in the WordPress admin dashboard without corresponding admin login events in authentication logs.

Users should update the Chartify – WordPress Chart Plugin to version 3.6.0 or later, which contains the patch addressing this vulnerability (the fix changeset is available on the WordPress plugin repository). No configuration-based workaround is documented; upgrading is the recommended and only reliable remediation. Site administrators unable to update immediately should consider temporarily deactivating the plugin to eliminate the attack surface (Wordfence, WordPress Trac Changeset).

Wordfence included CVE-2025-11171 in their weekly WordPress vulnerability report for October 6–12, 2025, highlighting it among other plugin vulnerabilities discovered that week (Wordfence Blog). A Bluesky post from a cybersecurity account referenced the vulnerability shortly after disclosure, indicating some community awareness. No major vendor statements or significant media coverage beyond standard vulnerability aggregation has been observed.