CVE-2026-9015

Vulnerability

The Equalize Digital Accessibility Checker plugin for WordPress fails to properly verify user authorization when processing requests to modify the ignore state, ignore reason, and ignore comment of accessibility issues. This affects all versions up to and including 1.42.0. The vulnerability exists in the REST API and AJAX endpoints that handle these modifications (as seen in the enqueue-admin.php files [1][2] and the class-ajax.php handler [3][4]), where no capability check is performed before updating the database. As a result, any authenticated user with subscriber-level access or higher can manipulate the ignore status of any issue across the entire site.

Exploitation

An attacker needs a valid WordPress account with at least the subscriber role. They can send crafted HTTP requests to the plugin's REST API (e.g., /accessibility-checker/v1/...) or AJAX actions, supplying parameters such as the issue ID, new ignore state, reason, comment, and optionally largeBatch=true. When largeBatch=true is provided, the plugin modifies all rows sharing the same object identifier, enabling mass dismissal of findings. The attacker must include a valid REST nonce (wp_rest) which is available to any authenticated user via the localized script variables [1][2].

Impact

Successful exploitation allows an attacker to hide or dismiss accessibility audit findings arbitrarily, corrupting the integrity of the audit data. This can conceal non-compliance with WCAG, ADA, EAA, or Section 508 standards from administrators, potentially leading to legal or regulatory penalties. The attacker does not gain code execution or access to sensitive data, but the audit trail is compromised.

Mitigation

As of the publication date (2026-05-28), no patched version has been released. Users should update to version 1.43.0 or later once available. As a temporary workaround, administrators can restrict subscriber-level access or disable the plugin until a fix is applied. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.