{"affected":[{"defaultStatus":"unaffected","product":"iChart","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.2.4","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-121998","cwes":["CWE-639"],"description":"The iChart  WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX actions, relying only on a nonce that any logged-in user can obtain, allowing users with a role as low as Subscriber to read, modify and permanently delete arbitrary posts and to overwrite a site-wide option.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/5e24fb30-d902-4195-b387-50a6411c2008/"}],"kev":null,"metrics":[],"modifiedAt":1794376812022,"publishedAt":1794376812022,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/5e24fb30-d902-4195-b387-50a6411c2008/"}],"remediation":[],"revision":"14fab5eab3a777fb31f16c0910f556b656da555286b2e358d31ce7a080b54309","sources":[{"modifiedAt":1794376812022,"name":"CNA: WPScan","retrievedAt":1794377414450,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121998"}],"ssvc":null,"status":"published","title":"iChart < 2.2.4 - Subscriber+ Arbitrary Post Read, Update and Deletion via IDOR","updatedAt":1794377414450}