What is the CVSS score of CVE-2025-30636?

CVE-2025-30636 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Accessibility Suite are affected by CVE-2025-30636?

CVE-2025-30636 presents moderate security risk, a missing authorization vulnerability rated CVSS 5.4. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2025-30636?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Accessibility Suite CVE-2025-30636

EUVD-2025-17197 MEDIUM

Missing Authorization (CWE-862)

2025-06-06 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L due to required authentication; AV:N via web; impacts integrity and availability only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17197

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

MEDIUM 5.4

DescriptionCVE.org

Missing Authorization vulnerability in Ability, Inc Accessibility Suite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Accessibility Suite: from n/a through 4.19.

AnalysisAI

Missing authorization in the WordPress Accessibility Suite plugin up to version 4.19 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or data. The vulnerability has a CVSS score of 5.4 (medium) and a low EPSS probability of 0.07%, with no evidence of active exploitation or public exploit code.

Technical ContextAI

The vulnerability is a Missing Authorization (CWE-862) flaw in the WordPress plugin Accessibility Suite by Ability, Inc. The plugin likely implements role-based access controls for its settings or features, but fails to properly enforce them for certain actions. CPE data indicates the affected product is the WordPress plugin 'online-accessibility' (Accessibility Suite) versions up to 4.19. The root cause is that the plugin does not verify whether the current user has the required permissions before executing sensitive operations, allowing low-privileged users (e.g., subscribers) to perform actions intended for administrators.

RemediationAI

Update the Accessibility Suite plugin to version 4.20 or later, as the vulnerability is fixed in that release. The vendor advisory from Patchstack provides details. As a workaround, restrict access to the WordPress admin area for low-privilege users if possible, but note that this may impact legitimate functionality. No other compensating controls are recommended as the patch is available.