What the vulnerability does
01Description
The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.42.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the ignore state, ignore reason, and ignore comment of arbitrary accessibility issues across the entire site — including mass modification of all rows sharing an 'object' identifier when largeBatch=true is supplied — corrupting accessibility audit integrity by hiding or dismissing findings outside their authorization scope.
Explanation of Vulnerability in Simple Terms
02Summary
The Equalize Digital Accessibility Checker plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to modify data they should not have access to. The vulnerability affects versions up to 1.42.0. An attacker with a basic user account can alter settings or content without proper permission checks. Update to a version newer than 1.42.0 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Modify plugin settings or data without proper authorization as a low-privilege authenticated user.
Potential impact on your site
04Site Impact
Unauthorized users can alter accessibility checker settings or data, potentially affecting site compliance reporting and configuration.
Conditions required to exploit
05Prerequisites
Attacker must have a valid WordPress user account with low-level privileges (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
May 28, 2026
CVE published
May 28, 2026
Record updated
