CVE-2026-121998: iChart < 2.2.4 - Subscriber+ Arbitrary Post Read, Update and Deletion via IDOR

Q: Which users can exploit this issue?

Any authenticated WordPress user, including a user with only the Subscriber role, can obtain the required nonce and invoke the affected AJAX actions.

Q: What can a successful attacker do?

They can read, modify, and permanently delete arbitrary posts. They can also overwrite a site-wide option.

Q: Is an unauthenticated attacker affected by this issue?

The available information indicates that an attacker must be logged in. The nonce requirement does not prevent exploitation by logged-in users because any authenticated user can obtain it.

Q: Which plugin versions are affected?

iChart versions before 2.2.4 are affected.

Published Nov 11, 2026

Updated

The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX actions, relying only on a nonce that any logged-in user can obtain, allowing users with a role as low as Subscriber to read, modify and permanently delete arbitrary posts and to overwrite a site-wide option.

Affected Software

1 affected component

iChart iChart WordPress plugin<2.2.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade iChart WordPress plugin to a version that resolves this vulnerability.
Fixed in 2.2.4

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated WordPress user, including a user with only the Subscriber role, can obtain the required nonce and invoke the affected AJAX actions.

What can a successful attacker do?

They can read, modify, and permanently delete arbitrary posts. They can also overwrite a site-wide option.

Is an unauthenticated attacker affected by this issue?

The available information indicates that an attacker must be logged in. The nonce requirement does not prevent exploitation by logged-in users because any authenticated user can obtain it.

Which plugin versions are affected?

iChart versions before 2.2.4 are affected.

CVE-2026-121998: iChart < 2.2.4 - Subscriber+ Arbitrary Post Read, Update and Deletion via IDOR

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue?

What can a successful attacker do?

Is an unauthenticated attacker affected by this issue?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What can a successful attacker do?

Is an unauthenticated attacker affected by this issue?

Which plugin versions are affected?