PT-2026-20592 · WordPress · Web Accessibility By Accessibe

Rafshanzani Suhada · Publicado 2026-02-19 · Atualizado 2026-02-23 · CVE-2025-13113

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Web Accessibility by accessiBe versions up to and including 2.11

Description The Web Accessibility by accessiBe plugin for WordPress is susceptible to exposure of sensitive information. This occurs because the accessibe render js in footer() function logs the complete plugin options array to the browser console on public pages without appropriate restrictions. This allows unauthenticated attackers to view sensitive configuration data, including email addresses, accessiBe user IDs, account IDs, and license information, via the browser console when the widget is disabled.

Recommendations Versions prior to 2.11 should be updated to a newer version that addresses this issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2025-13113

Produtos afetados

Web Accessibility By Accessibe

Referências · 5

• https://t.me/CVEtracker/45061 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-13113 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399416%40accessibe&new=3399416%40accessibe&sfp_email=&sfph_mail= · Nota
• https://twitter.com/CVEnew/status/2025892090417197151 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/aa107267-2e67-48bf-968c-7f741ecbd786?source=cve · Nota