What is the CVSS score of EUVD-2026-48143?

EUVD-2026-48143 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

WP Accessibility Helper EUVD-2026-48143

| CVE-2026-24537 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-23 Patchstack

GHSA-92gw-vp7j-x89j

WordPress CSRF Wordpress Plugin Wp Accessibility Helper Wah

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable with no privileges required, but mandatory active user interaction; impact is integrity-only as CSRF enables unauthorized actions without data disclosure.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:16 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions.

AnalysisAI

Cross-Site Request Forgery in WP Accessibility Helper (WAH) plugin versions 0.6.6 and below enables remote unauthenticated attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated WordPress administrator into visiting a crafted malicious page. The vulnerability arises from missing or unvalidated nonce checks on sensitive plugin endpoints, allowing forged cross-origin requests to execute in the victim's authenticated session context. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.

Technical ContextAI

WP Accessibility Helper (WAH) is a WordPress plugin authored by Alex Volkov (CPE: cpe:2.3:a:alex_volkov:wp_accessibility_helper_(wah):*:*:*:*:*:*:*:*) designed to assist sites in meeting web accessibility standards. The root cause is CWE-352 (Cross-Site Request Forgery), which occurs when a web application does not sufficiently verify that a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. In the WordPress ecosystem, the standard defense is to generate and validate cryptographic nonces via wp_nonce_field() and check_admin_referer() or verify_nonce() on all state-changing handlers. The absence of this check on one or more WAH plugin actions means any authenticated user's browser can be coerced into submitting forged requests that the plugin accepts as legitimate.

RemediationAI

Update WP Accessibility Helper (WAH) to a version above 0.6.6 as soon as a patched release becomes available from the plugin author; no specific fixed version has been confirmed from available data at time of analysis. Monitor the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-accessibility-helper/vulnerability/wordpress-wp-accessibility-helper-wah-plugin-0-6-6-cross-site-request-forgery-csrf-vulnerability for patch announcements. As a compensating control, WordPress administrators should avoid browsing untrusted external sites while authenticated to their WordPress admin panel, reducing the attack surface for CSRF delivery. Deploying a Web Application Firewall (WAF) capable of detecting CSRF patterns, such as the Patchstack WAF, can provide virtual patching until an official fix is released. If the WAH plugin is not actively required, disabling or removing it entirely eliminates the exposure with no functional trade-off for non-accessibility-dependent sites.