What is the CVSS score of CVE-2026-3773?

CVE-2026-3773 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3773

EUVD-2026-23190 MEDIUM

SQL Injection (CWE-89)

2026-04-16 Wordfence

GHSA-rg9x-pgh3-3gwf

WordPress SQLi

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 16, 2026 - 06:01 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 05:45 euvd

EUVD-2026-23190

Analysis Generated

Apr 16, 2026 - 05:45 vuln.today

CVE Published

Apr 16, 2026 - 05:29 nvd

MEDIUM 6.5

DescriptionCVE.org

The Accessibility Suite by Ability, Inc plugin for WordPress is vulnerable to SQL Injection via the 'scan_id' parameter in all versions up to, and including, 4.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in Accessibility Suite by Ability, Inc WordPress plugin (versions up to 4.20) allows authenticated attackers with Subscriber-level access to extract sensitive database information via an unescaped 'scan_id' parameter. The vulnerability is unauthenticated remote network-accessible but requires low-privilege login credentials; no public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability exists in the WordPress plugin's AJAX handler for false-positive processing, where the 'scan_id' parameter is passed directly into SQL queries without proper escaping or parameterized preparation. WordPress uses the $wpdb->prepare() function to safely construct prepared statements; this plugin fails to use it, allowing attackers to manipulate SQL syntax. CWE-89 (SQL Injection) occurs because user-controlled input from the 'scan_id' parameter reaches the database query layer without sanitization. The affected CPE cpe:2.3:a:onlineada:accessibility_suite_by_ability,_inc identifies the plugin developed by Online ADA (OnlineADA company). Code references point to false-positives.php and Helper.php classes where the injection point exists.

RemediationAI

Update Accessibility Suite by Ability, Inc to a patched version released after 4.20; the vendor is responsible for releasing a fixed version with proper SQL parameter preparation (use $wpdb->prepare() with placeholders). Until an updated version is available, restrict Subscriber-level account creation and assignment to trusted users only-WordPress administrators should audit existing Subscriber accounts and remove those that are unnecessary or belong to untrusted parties. As a temporary compensating control, disable or restrict access to the plugin's AJAX endpoints handling false-positive scans if the functionality is not actively used; this can be done via web application firewall (WAF) rules blocking POST requests to wp-admin/admin-ajax.php with the 'action' parameter matching the vulnerable handler. Note that disabling the endpoint may break the plugin's false-positive reporting feature. Monitor WordPress user access logs for suspicious database queries originating from low-privilege accounts. Apply the Wordfence vulnerability advisory link (https://www.wordfence.com/threat-intel/vulnerabilities/id/b882ba6d-47c0-401a-bf50-5cf0bf0f3d5b?source=cve) to verify patch availability when released.