What is CVE-2025-11171?

CVE-2025-11171 is a medium-severity vulnerability in Ays-pro Chartify – Wordpress Chart Plugin, classified under Missing Authentication for Critical Function. CVSS score: 5.3/10. Published 2025-10-08.

How severe is CVE-2025-11171?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Is CVE-2025-11171 known to be exploited?

4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Ays-pro Chartify – Wordpress Chart Plugin

CVE-2025-11171

The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9. This is due to the plugin registering an unauthenticated AJAX action that dispat…

Vulnerability class: Broken Authentication

EPSS: 0.003 (57.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Ays-pro Chartify – Wordpress Chart Plugin — versions 0

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2025-11171?: CVE-2025-11171 is a medium-severity vulnerability in Ays-pro Chartify – Wordpress Chart Plugin, classified under Missing Authentication for Critical Function. CVSS score: 5.3/10. Published 2025-10-08.
How severe is CVE-2025-11171?: Medium severity. CVSS v3 base score is 5.3 out of 10.
Is CVE-2025-11171 known to be exploited?: 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.