Technical impact
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor allows Password Recovery Exploitation. An attacker can bypass authentication controls in the Graphina plugin up to version 3.1.12, enabling unauthorized privileged actions and potentially compromising site data and functionality. This flaw is identified as CWE‑288.
Affected Systems
The vulnerability impacts the Iqonic Design Graphina plugin for WordPress on any installation running version 3.1.12 or earlier. No additional affected versions are listed, so sites should ensure they are not using the vulnerable range.
Risk and Exploitability
The CVSS score of 7.5 indicates high severity. The EPSS score of 0.485% reflects a very low yet non‑zero likelihood that this flaw is currently being exploited in the wild. The flaw is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploits yet. However, because the vulnerability allows an unauthenticated attacker to bypass authentication checks, any host exposed to the internet could be compromised if the Graphina plugin remains vulnerable.
