PT-2026-20592 · WordPress · Web Accessibility By Accessibe

Rafshanzani Suhada · Published 2026-02-19 · Updated 2026-02-23 · CVE-2025-13113

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Web Accessibility by accessiBe versions up to and including 2.11

Description The Web Accessibility by accessiBe plugin for WordPress is susceptible to exposure of sensitive information. This occurs because the accessibe render js in footer() function logs the complete plugin options array to the browser console on public pages without appropriate restrictions. This allows unauthenticated attackers to view sensitive configuration data, including email addresses, accessiBe user IDs, account IDs, and license information, via the browser console when the widget is disabled.

Recommendations Versions prior to 2.11 should be updated to a newer version that addresses this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-13113

Affected Products

Web Accessibility By Accessibe

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-13113 · Security Note
• https://t.me/CVEtracker/45061 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399416%40accessibe&new=3399416%40accessibe&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2025892090417197151 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/aa107267-2e67-48bf-968c-7f741ecbd786?source=cve · Note