Wp Accessibility Helper Wah
Monthly
Cross-Site Request Forgery in WP Accessibility Helper (WAH) plugin versions 0.6.6 and below enables remote unauthenticated attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated WordPress administrator into visiting a crafted malicious page. The vulnerability arises from missing or unvalidated nonce checks on sensitive plugin endpoints, allowing forged cross-origin requests to execute in the victim's authenticated session context. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Cross-Site Request Forgery in WP Accessibility Helper (WAH) plugin versions 0.6.6 and below enables remote unauthenticated attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated WordPress administrator into visiting a crafted malicious page. The vulnerability arises from missing or unvalidated nonce checks on sensitive plugin endpoints, allowing forged cross-origin requests to execute in the victim's authenticated session context. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.