The Chartify – WordPress Chart Plugin (versions up to 3.5.9) suffers from a Missing Authentication for Critical Function vulnerability (CWE-306). This occurs because the plugin exposes an AJAX action that does not require authentication or capability verification, allowing unauthenticated users to invoke administrative methods if they know the method names. The vulnerability is accessible through the wp-admin/admin-ajax.php endpoint and can lead to unauthorized administrative function execution. The CVSS 3.1 base score is 5.3, reflecting medium impact primarily on integrity. There is no vendor-provided patch or advisory available at this time.

An unauthenticated attacker can invoke administrative functions in the plugin via AJAX requests without any authentication or authorization checks. This can lead to unauthorized modification of plugin settings or data integrity issues. There is no direct confidentiality or availability impact indicated. No known exploits have been reported, but the vulnerability could be leveraged if callable method names are discovered.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the wp-admin/admin-ajax.php endpoint where possible, and monitor for suspicious AJAX requests targeting the plugin. Avoid exposing the plugin to untrusted users. Follow vendor updates closely for an official fix.