EUVD-2026-23190
GHSA-rg9x-pgh3-3gwf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Accessibility Suite by Ability, Inc plugin for WordPress is vulnerable to SQL Injection via the 'scan_id' parameter in all versions up to, and including, 4.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in Accessibility Suite by Ability, Inc WordPress plugin (versions up to 4.20) allows authenticated attackers with Subscriber-level access to extract sensitive database information via an unescaped 'scan_id' parameter. The vulnerability is unauthenticated remote network-accessible but requires low-privilege login credentials; no public exploit code or active exploitation has been identified at the time of analysis.
Technical ContextAI
The vulnerability exists in the WordPress plugin's AJAX handler for false-positive processing, where the 'scan_id' parameter is passed directly into SQL queries without proper escaping or parameterized preparation. WordPress uses the $wpdb->prepare() function to safely construct prepared statements; this plugin fails to use it, allowing attackers to manipulate SQL syntax. CWE-89 (SQL Injection) occurs because user-controlled input from the 'scan_id' parameter reaches the database query layer without sanitization. The affected CPE cpe:2.3:a:onlineada:accessibility_suite_by_ability,_inc identifies the plugin developed by Online ADA (OnlineADA company). Code references point to false-positives.php and Helper.php classes where the injection point exists.
RemediationAI
Update Accessibility Suite by Ability, Inc to a patched version released after 4.20; the vendor is responsible for releasing a fixed version with proper SQL parameter preparation (use $wpdb->prepare() with placeholders). Until an updated version is available, restrict Subscriber-level account creation and assignment to trusted users only-WordPress administrators should audit existing Subscriber accounts and remove those that are unnecessary or belong to untrusted parties. As a temporary compensating control, disable or restrict access to the plugin's AJAX endpoints handling false-positive scans if the functionality is not actively used; this can be done via web application firewall (WAF) rules blocking POST requests to wp-admin/admin-ajax.php with the 'action' parameter matching the vulnerable handler. Note that disabling the endpoint may break the plugin's false-positive reporting feature. Monitor WordPress user access logs for suspicious database queries originating from low-privilege accounts. Apply the Wordfence vulnerability advisory link (https://www.wordfence.com/threat-intel/vulnerabilities/id/b882ba6d-47c0-401a-bf50-5cf0bf0f3d5b?source=cve) to verify patch availability when released.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today