The DASHBOARD BUILDER WordPress plugin for Charts and Graphs suffers from a CSRF vulnerability (CWE-352) in all versions up to 1.5.7. The root cause is the absence of nonce validation in the settings handler within dashboardbuilder-admin.php. An attacker can exploit this by tricking a site administrator into submitting a forged request, which modifies the stored SQL query and database credentials used by the [show-dashboardbuilder] shortcode. When the shortcode is rendered on the front-end, the malicious SQL query executes, enabling arbitrary SQL injection and data exfiltration via the publicly visible chart output. The CVSS 3.1 base score is 7.1 (High), reflecting network attack vector, no privileges required, user interaction required, and high confidentiality impact.

Successful exploitation allows an unauthenticated attacker to perform CSRF attacks that modify SQL queries and database credentials stored by the plugin. This leads to arbitrary SQL injection executed on the front-end, resulting in potential data exfiltration through chart outputs visible to site visitors. The confidentiality impact is high, while integrity impact is low and availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while logged into WordPress admin and consider disabling or removing the vulnerable plugin to prevent exploitation.