What is the CVSS score of EUVD-2026-32745?

EUVD-2026-32745 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Accessibility Checker EUVD-2026-32745

| CVE-2026-9015 MEDIUM

Missing Authorization (CWE-862)

2026-05-28 Wordfence

GHSA-42g4-cgrh-279c

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 09:20 vuln.today

CVE Published

May 28, 2026 - 07:43 nvd

MEDIUM 4.3

DescriptionCVE.org

The Equalize Digital Accessibility Checker - WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.42.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the ignore state, ignore reason, and ignore comment of arbitrary accessibility issues across the entire site - including mass modification of all rows sharing an 'object' identifier when largeBatch=true is supplied - corrupting accessibility audit integrity by hiding or dismissing findings outside their authorization scope.

AnalysisAI

Authorization bypass in the Equalize Digital Accessibility Checker WordPress plugin (all versions through 1.42.0) allows low-privileged authenticated users to corrupt accessibility audit integrity site-wide. Authenticated attackers holding subscriber-level accounts or higher can invoke AJAX endpoints in class-ajax.php to modify the ignore state, ignore reason, and ignore comment of any accessibility issue across the entire site, effectively hiding or dismissing audit findings they are not authorized to manage. The vulnerability is amplified by a mass-modification code path triggered when the largeBatch=true parameter is supplied, enabling bulk suppression of all findings sharing a common object identifier in a single request. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the plugin's AJAX handler class at admin/class-ajax.php (confirmed across plugin versions 1.38.0 and 1.41.0 via WordPress Trac references at lines L40, L814, and L856). The root cause is CWE-862 (Missing Authorization): the AJAX action handlers responsible for updating accessibility issue ignore states do not perform adequate capability checks to confirm whether the requesting user is permitted to modify a given record. WordPress plugins typically gate privileged actions via current_user_can() checks or nonce verification tied to specific capabilities; the absence or insufficiency of such checks here permits any subscriber-level user - the lowest authenticated WordPress role - to invoke these handlers. The largeBatch=true parameter further exposes a bulk-operation code path with the same missing authorization, compounding the integrity impact. The affected CPE is cpe:2.3:a:equalizedigital:equalize_digital_accessibility_checker_-_wcag,_ada,_eaa_and_section_508_compliance:*:*:*:*:*:*:*:*.

RemediationAI

An upstream fix has been committed to the WordPress plugin repository via changeset 3539961 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3539961%40accessibility-checker&new=3539961%40accessibility-checker); however, the exact patched release version number is not confirmed in the available data - operators should check the plugin's changelog for the first version after 1.42.0 that references this changeset and upgrade to that version immediately via the WordPress admin dashboard or WP-CLI. Until the upgrade is applied, a practical compensating control is to restrict plugin installation and WordPress account registration to prevent untrusted users from holding subscriber-level roles; on sites where subscriber accounts are necessary (e.g., membership or LMS platforms), consider temporarily disabling the Accessibility Checker plugin to prevent manipulation of audit state, accepting the trade-off of losing active accessibility scanning during the remediation window. There is no known configuration toggle to disable only the AJAX bulk-modification endpoint without modifying plugin code directly.