The Graphina – Charts and Graphs For Elementor plugin (versions up to 3.1.12) contains an authorization flaw that permits an unauthenticated user to exploit incorrectly configured access‑control security levels. This vulnerability allows the attacker to perform actions normally reserved for privileged users, such as editing or deleting chart data, or accessing administrative components of the plugin. The result is unauthorized manipulation or exposure of graph-related content on a WordPress site.

The affected product is the Graphina plugin by Iqonic Design, versions 3.1.12 and earlier. Any WordPress site that has these versions of the plugin installed is susceptible to the flaw.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score of less than 1% signals that the probability of exploitation is very low, and the vulnerability is not currently listed in the CISA KEV catalog. The most likely attack vector involves an attacker sending specially crafted HTTP requests to the plugin’s access endpoints, a maneuver that can be performed without authenticating to the site. Successful exploitation would grant the attacker unauthorized control over the plugin’s features and potentially the hosting webpage’s content.