Product
The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX actions, allowing users with a role as low as Subscriber to read, modify, delete arbitrary posts, and overwrite a site-wide option.