WordPress Plugin Vulnerabilities

WP Accessibility Helper (WAH) < 0.6.2.6 - Missing Authorization

Description

The WP Accessibility Helper (WAH) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_attachment_alt() function in versions up to, and including, 0.6.2.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to update attachment alts.

Affects Plugins

Plugin icon
wp-accessibility-helper
Fixed in 0.6.2.6

References

CVE
CVE-2024-31423
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/fc186712-5314-4471-bf02-4fd580c338c9

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Mika
Verified
No
WPVDB ID
ac7f88c6-863c-4244-9d41-013dddc03ffb

Timeline

Publicly Published
2024-04-10 (about 2 years ago)
Added
2024-04-16 (about 2 years ago)
Last Updated
2024-04-16 (about 2 years ago)

Other

Published
Title
Published
2024-11-20
Title
Bard Extra < 1.2.8 - Missing Authorization to Authenticated (Subscriber+) Demo Import
Published
2026-01-27
Title
ELEX WordPress HelpDesk & Customer Ticketing System < 3.3.6 - Missing Authorization
Published
2026-05-19
Title
TypeSquare Webfonts for ConoHa <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via 'fontThemeUseType' Parameter
Published
2024-02-14
Title
WP Setup Wizard < 1.0.8.2 - Authenticated (Subscriber+) Full Database Download
Published
2025-06-05
Title
Job Board Manager < 2.1.61 - Missing Authorization