Unauthenticated administrative actions via unchecked AJAX dispatch

Missing authentication in AYS Pro Chartify 3.5.9 and earlier allows remote attackers to execute administrative functions via AJAX. The plugin registers a public admin-ajax.php action that accepts a request-supplied method name and dispatches it to an admin-class method without a nonce or capability check. No account or user interaction is required, but exploitation depends on identifying a callable method; the published impact is limited to unauthorized modification.