CVE-2026-3773
SQL Injection in Accessibility Suite WordPress Plugin Allows Data Exposure
Publication date: 2026-04-16
Last updated on: 2026-04-16
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ability_inc | accessibility_suite | to 4.20 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Accessibility Suite by Ability, Inc plugin for WordPress has a vulnerability in the 'scan_id' parameter that allows SQL Injection. This happens because the plugin does not properly escape or prepare the user-supplied 'scan_id' parameter in its SQL queries.
Authenticated users with Subscriber-level access or higher can exploit this flaw by appending additional SQL queries to the existing ones, potentially extracting sensitive information from the database.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers with Subscriber-level access and above to perform SQL Injection attacks that can extract sensitive information from the database.
Such unauthorized access and potential data extraction could lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding sensitive information against unauthorized access.
However, the provided information does not explicitly discuss the impact on compliance with these standards.
How can this vulnerability impact me? :
This vulnerability can allow attackers with low-level authenticated access to extract sensitive information from the database by injecting malicious SQL queries.
Although it does not allow modification or deletion of data (as indicated by the CVSS vector showing no impact on integrity or availability), the confidentiality of data is highly impacted.