# CVE-2026-65529: Iqonic Design Graphina broken access control

Source: https://junglewise.ai/threats/cve-2026-65529-iqonic-design-graphina-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65529 · Severity: medium · CVSS 5.3 · Published 2026-07-23

Graphina is a WordPress plugin used to create interactive charts and graphs within the Elementor page builder. A security flaw in versions 3.1.12 and earlier allows unauthorized individuals to bypass access controls, potentially leading to the exposure of restricted information. While the impact is currently rated as medium, it could allow an attacker to view data they are not permitted to see without needing to log in.

Vendors: [Iqonic Design](https://junglewise.ai/threats/vendors/iqonic-design).

## Quick answers

**Is CVE-2026-65529 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65529 being exploited in the wild.

**How severe is CVE-2026-65529?** Medium severity, with a CVSS score of 5.3, published 23 July 2026.

**Which products and versions are affected?** Iqonic Design Graphina - Elementor Charts and Graphs <= 3.1.12.

**Is there a fix for CVE-2026-65529?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65529 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-65529?** Check whether you run Iqonic Design Graphina - Elementor Charts and Graphs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Graphina plugin for WordPress (specifically the 'graphina-elementor-charts-and-graphs' package) is vulnerable to broken access control due to missing authorization checks (CWE-862). An unauthenticated remote attacker can exploit this flaw to perform actions or access data that should be restricted to higher-privileged users. The vulnerability exists in versions up to and including 3.1.12. As of the advisory date, no official patch has been confirmed, though users are advised to monitor for updates from Iqonic Design.

## Affected products

- Iqonic Design Graphina - Elementor Charts and Graphs <= 3.1.12

## Timeline

- 2026-06-10: other: Vulnerability reported by researcher Ananda Dhakal
- 2026-07-23: disclosed: Vulnerability details published by Patchstack and NVD

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/graphina-elementor-charts-and-graphs/vulnerability/wordpress-graphina-plugin-3-1-12-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/graphina-elementor-charts-and-graphs/vulnerability/wordpress-graphina-plugin-3-1-12-broken-access-control-vulnerability?_s_id=cve)