PT-2026-33268 · Ability · Accessibility Suite

Victor Pasman · Published 2026-04-16 · Updated 2026-04-24 · CVE-2026-3773

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Accessibility Suite by Ability, Inc versions prior to 4.21

Description The Accessibility Suite by Ability, Inc plugin for WordPress contains a flaw allowing authenticated attackers with Subscriber-level access or higher to perform SQL Injection. This occurs because the scan id parameter is not properly escaped and the SQL query is not sufficiently prepared, enabling the execution of additional queries to extract sensitive information from the database.

Recommendations Update the plugin to a version later than 4.20. As a temporary workaround, restrict access to the scan id parameter until the update is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-3773

Affected Products

Accessibility Suite

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-3773 · Security Note
• https://twitter.com/VulmonFeeds/status/2044758741367582725 · Twitter Post
• https://reddit.com/r/StopBadBots/comments/1su8tkw/unpatched_threat_why_you_must_remove_these_29 · Reddit Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b882ba6d-47c0-401a-bf50-5cf0bf0f3d5b?source=cve · Note
• https://twitter.com/CVEnew/status/2044701565232324882 · Twitter Post
• https://plugins.trac.wordpress.org/browser/online-accessibility/trunk/includes/ajax_functions/false-positives.php#L20 · Note
• https://plugins.trac.wordpress.org/browser/online-accessibility/trunk/includes/classes/Helper.php#L166 · Note