WordPress Plugin Vulnerabilities

Web Accessibility By accessiBe < 2.11 - Missing Authorization

Description

The Web Accessibility By accessiBe plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX functions in versions up to, and including, 2.10. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions.

Affects Plugins

Plugin icon
accessibe
Fixed in 2.11

References

CVE
CVE-2025-49920
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/997e5fdb-cece-4850-a0e4-49343d9c415d

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Legion Hunter
Verified
No
WPVDB ID
4954c45a-1465-4db1-bbba-1937c91efd61

Timeline

Publicly Published
2025-10-27 (about 8 months ago)
Added
2025-11-04 (about 7 months ago)
Last Updated
2025-11-04 (about 7 months ago)

Other

Published
Title
Published
2026-05-21
Title
GSheet For Woo Importer < 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset
Published
2025-03-03
Title
Animation Addons for Elementor Pro < 1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
Published
2025-12-08
Title
Eupago Gateway For Woocommerce <= 4.7.1 - Missing Authorization
Published
2026-03-20
Title
Speedup Optimization <= 1.5.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via 'speedup01_enabled' AJAX Action
Published
2024-12-11
Title
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses < 3.2.22 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Update