CVE-2025-66529: 
WordPress vulnerability analysis and mitigation

CVE-2025-66529 is a Cross-Site Request Forgery (CSRF) vulnerability in the Ays Pro Chartify (chart-builder) WordPress plugin, affecting all versions up to and including 3.6.3. The vulnerability allows unauthenticated attackers to trick authenticated users into performing unauthorized actions within the plugin. It was reported by researcher Doan Dinh Van on November 3, 2025, and published by Patchstack on December 3, 2025. The CVE was formally published on December 9, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from insufficient or absent CSRF token validation in the Chartify plugin's request handling. An attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user, silently submits forged requests to the plugin's endpoints on the victim's behalf. Exploitation requires no privileges from the attacker but does require user interaction — specifically, a logged-in user must be tricked into clicking a malicious link or visiting a crafted page. No technical write-up or public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation could allow an attacker to force authenticated users — potentially administrators — to perform unintended actions within the Chartify plugin, such as modifying chart configurations, altering plugin settings, or executing other administrative operations without the user's knowledge. The integrity impact is limited (low), with no direct confidentiality or availability impact. However, unauthorized changes to plugin settings or chart data could compromise the integrity of the WordPress site's content and functionality (Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is extremely low at 0.000080, reflecting a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while CSRF vulnerabilities of this type can be used in mass-exploit campaigns targeting WordPress plugins broadly, this specific issue is assessed as low priority and unlikely to be exploited (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Chartify plugin version 3.6.3 or earlier, using tools like WPScan or Shodan to enumerate plugin versions.
2. Craft malicious payload: Create an HTML page or link containing a forged form or JavaScript that automatically submits a request to the target WordPress site's Chartify plugin endpoint (e.g., a chart modification or settings update action).
3. Deliver the payload: Trick an authenticated WordPress user (ideally an administrator) into visiting the malicious page or clicking the crafted link, via phishing email, social engineering, or embedding in a comment/forum post.
4. Forged request executes: The victim's browser automatically sends the forged request with their active session cookies, causing the Chartify plugin to process the unauthorized action (e.g., modifying chart data or plugin settings) without the user's knowledge (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to Chartify plugin endpoints (e.g., /wp-admin/admin-ajax.php or plugin-specific action URLs) from unusual referrer origins or with no referrer header.
• Application: Unexplained changes to chart configurations or Chartify plugin settings without corresponding administrator activity in the WordPress audit log.
• Network: Requests to Chartify plugin endpoints originating from external or unexpected domains in the HTTP Referer header.

The vulnerability is patched in Chartify version 3.6.4. WordPress site administrators should update the Chartify plugin to version 3.6.4 or later immediately. If an immediate update is not possible, consider temporarily deactivating the plugin or using a WordPress security plugin (such as Patchstack) that provides virtual patching or additional CSRF protection. Users should also be cautious about clicking unknown links while logged into their WordPress admin panel (Patchstack).