The vulnerability lies in the Ays Pro Chartify plugin for WordPress, allowing attackers to forge requests that the site will accept as legitimate from an authenticated user. Because the flaw exists in the chart‑building functionality, an attacker can submit forms or AJAX calls that trigger unwanted actions within the user’s account, potentially altering data or settings. The flaw is classified as CWE‑352, indicating a weakness in preventing the use of forged requests.

Any WordPress site that has the Chartify plugin installed in a version up to and including 3.5.3 is vulnerable. The affected product is the "Ays Pro: Chartify" WordPress plugin; no specific WordPress core versions are mentioned, so any compatible WordPress installation using the vulnerable plugin is at risk.

The CVSS score of 4.3 labels the problem as moderate. The EPSS score of less than 1% indicates that real‑world exploitation is unlikely at the moment. The vulnerability is not listed in the CISA KEV catalogue, further suggesting limited exploitation. The likely attack vector is a crafted HTTP request sent by an attacker’s domain that the victims are already authenticated to the site, leading to an unintended action without additional user interaction.