CVE-2026-121998
iChart < 2.2.4 - Subscriber+ Arbitrary Post Read, Update and Deletion via IDOR
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX actions, relying only on a nonce that any logged-in user can obtain, allowing users with a role as low as Subscriber to read, modify and permanently delete arbitrary posts and to overwrite a site-wide option.
| Vendor | unknown |
| Product | ichart |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown ichart
Be the first to know when new unknown vulnerabilities affecting unknown ichart are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / iChart
0 < 2.2.4
References
Credits
Hariom Singh WPScan