Critical flaw reported in Chartify WordPress Chart Plugin
Take action: If you are using the Chartify WordPress Chart Plugin, update the plugin IMMEDIATELY. It's not a widely used plugin, but is still high risk.
Learn More
A critical vulnerability has been discovered in the Chartify WordPress Chart Plugin, actively being exploited in the wild.
The vulnerability is tracked as CVE-2024-10571 (CVSS score 9.8): Unauthenticated Local File Inclusion vulnerability and allows attackers to execute malicious code through improper handling of 'source' parameter, enabling access control bypass and sensitive data extraction. It permits code execution when "safe" file types can be uploaded and included. Affected versions are all up to and including 2.9.5
Wordfence reported blocking 2,207,540 attacks within 24 hours.
The vulnerability has been patched in version 2.9.6. Website administrators are urged to update immediately to this or newer versions.
