CVE-2026-9199: Equalize Digital Accessibility Checker Authorization Bypass – WCAG Compliance Risk

Technical summary

CVE-2026-9199 is an authorization bypass vulnerability in the Equalize Digital Accessibility Checker plugin (all versions up to 1.42.1). The vulnerability stems from insufficient authorization checks in the dismiss-issue handler. When an authenticated author submits a dismiss request with the largeBatch=true parameter and references an accessibility issue from their own post, the handler fails to verify post-edit permissions for target issues and instead bulk-modifies all site-wide issues matching the same 'object' value. This circumvents WordPress's post-level access controls and allows unprivileged users to alter compliance records across the entire installation. The root cause is CWE-862 (Improper Authorization), indicating the plugin verifies user authentication but not their authorization to perform the specific action on specific resources.

Business impact

Organizations relying on the Equalize Digital Accessibility Checker for WCAG, ADA, EAA, and Section 508 compliance tracking face integrity risks. An author-level employee could selectively suppress or restore accessibility findings site-wide, creating false compliance postures. This is particularly damaging in regulated environments where audit trails and remediation records are subject to legal review or regulatory audit. The plugin's role in accessibility compliance means corrupted records could expose the organization to liability claims and failed compliance certifications. While the CVSS score is moderate (4.3), the reputational and legal implications of tampered compliance records may exceed the technical severity rating.

Affected systems

The vulnerability affects all versions of the Equalize Digital Accessibility Checker plugin up to and including version 1.42.1. Any WordPress site with this plugin installed and users holding author-level or administrator roles is at risk. The vulnerability requires authentication, so public-facing sites without logged-in author accounts are not directly exposed. However, any site with contributor or author accounts—common in multi-author publishing environments—can be exploited by insiders or compromised author credentials.

Exploitability

Exploitability is moderate but practical. An attacker requires valid WordPress credentials at author level or above—a common account type on content-driven sites. No complex interaction is needed; the exploit is a single HTTP request with modified parameters. The largeBatch=true flag combined with a crafted issue reference triggers the bulk-modify behavior. Detection by site administrators is difficult because the action appears to originate from a legitimate user. No patch currently exists in widely deployed versions, meaning organizations are exposed until they upgrade or disable the plugin. The lack of exploitation sophistication and low barrier to entry (author credentials are often less guarded than admin) make this practically exploitable in real-world scenarios.

Remediation

Update the Equalize Digital Accessibility Checker plugin immediately to a patched version beyond 1.42.1 (verify against the vendor advisory for the exact patched version). The vendor should have released a corrected version that enforces proper authorization checks, verifying that the user has post-edit capability on each issue's associated post before allowing modification. Until patched, consider temporarily disabling the plugin or restricting author-level role assignments to trusted users only. Organizations should audit their accessibility audit records for unexplained dismissals or restorations, particularly any bulk changes made by non-administrator users.

Patch guidance

Apply the latest version of the Equalize Digital Accessibility Checker plugin as released by the vendor. Check the official WordPress plugin repository and the vendor's security advisory for confirmation that the patch version addresses CWE-862 authorization bypass. After patching, verify that dismiss-issue and restoration operations now properly check post-edit capabilities. Test by creating a post as a non-admin author, creating an issue, then attempting to dismiss issues from another author's post—this should fail post-patch. Review the plugin's changelog to confirm the authorization check was added. Given the compliance-critical nature of this plugin, schedule patching during a maintenance window and test in a staging environment first.

Detection guidance

Monitor WordPress audit logs and database queries for bulk modifications to accessibility issue records, particularly those originating from non-administrator users. Look for dismiss-issue requests with the largeBatch parameter set to true or unusual spike in issue status changes. Check for requests where the user modifying an issue differs from the post author of the associated accessibility issue. If your site uses a security plugin (e.g., Wordfence, Sucuri), enable logging for post-edit attempts and cross-reference with author-level users. Query the plugin's database tables directly to identify any accessibility issues dismissed by users who lack edit_post capability on the issue's parent post. Set up alerts for any author-level user modifying issues belonging to administrator posts.

Why prioritize this

This vulnerability merits immediate attention despite a moderate CVSS score because it directly undermines compliance record integrity in a plugin deployed specifically for regulatory adherence. The ease of exploitation (requiring only author credentials and a simple request parameter), the lack of easily detectable logs, and the reputational/legal exposure from corrupted compliance audits elevate practical risk above the technical severity. Multi-author WordPress sites and organizations in regulated industries should prioritize this patch within their standard security update cycles.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects a low-severity impact (integrity only, no confidentiality or availability loss) that requires authentication (PR:L) and network access. However, the score alone undersells the risk: the vulnerability enables systematic tampering with compliance records through low-effort insider attacks, and the plugin's specialized role in regulatory compliance creates outsized business impact. Organizations should apply their own risk multiplier based on their regulatory exposure, multi-author user base size, and trust model for author-level accounts.

Frequently asked questions