PT-2026-24548 · WordPress+1 · Ally – Web Accessibility & Usability+1

Drew Webber · Published 2026-03-10 · Updated 2026-04-06 · CVE-2026-2413

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Ally – Web Accessibility & Usability plugin for WordPress versions prior to 4.1.0

Description The Ally – Web Accessibility & Usability plugin for WordPress is susceptible to SQL Injection through the URL path. This occurs because of inadequate escaping of the user-supplied URL parameter within the get global remediations() method. The parameter is directly incorporated into an SQL JOIN clause without appropriate sanitization for SQL context, despite the application of esc url raw() for URL safety, which does not prevent SQL metacharacters from being injected. This allows unauthenticated attackers to append additional SQL queries to existing queries, potentially extracting sensitive information from the database using time-based blind SQL injection techniques. The Remediation module must be active, requiring a connection to an Elementor account, for the vulnerability to be exploitable. Approximately 400,000 WordPress sites are affected.

Recommendations Update to version 4.1.0 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-2413

Affected Products

Ally – Web Accessibility & Usability

Elementor

References · 33

• https://nvd.nist.gov/vuln/detail/CVE-2026-2413 · Security Note
• https://twitter.com/shakquraa/status/2032494395367530717 · Twitter Post
• https://reddit.com/r/cybermaterial/comments/1rsmzmy/critical_sqli_bug_hits_ally_plugin_sites · Reddit Post
• https://wordfence.com/threat-intel/vulnerabilities/id/00e070b7-bdf6-4a80-a3ee-628243f1cc25?source=cve · Note
• https://twitter.com/cybernewslive/status/2032742115080376577 · Twitter Post
• https://twitter.com/CyberDaily_News/status/2032098005738828284 · Twitter Post
• https://plugins.trac.wordpress.org/browser/pojo-accessibility/tags/4.0.3/modules/remediation/classes/utils.php#L17 · Note
• https://twitter.com/threatcluster/status/2032114695155368420 · Twitter Post
• https://plugins.trac.wordpress.org/browser/pojo-accessibility/tags/4.0.3/modules/remediation/database/remediation-entry.php#L215 · Note
• https://reddit.com/r/TechNadu/comments/1rrrqgq/sql_injection_vulnerability_in_elementor_ally · Reddit Post
• https://twitter.com/VivekIntel/status/2031983042294935769 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1rstoe9/sql_injection_in_ally_plugin_exposes_over_200k · Reddit Post
• https://twitter.com/pdnuclei_bot/status/2032169785543573552 · Twitter Post
• https://twitter.com/RedPacketSec/status/2031894854293237995 · Twitter Post
• https://t.me/CVEtracker/47089 · Telegram Post