Unauthorized Page Creation in CodeConfig Accessibility Plugin for WordPress

CVE-2025-13358

What is CVE-2025-13358?

The CodeConfig Accessibility plugin for WordPress, up to version 1.0.0, allows authenticated users with Subscriber-level access or higher to exploit a lack of authorization checks. The vulnerability arises in the Settings::createPage() function, which does not enforce capability checks, enabling attackers to create arbitrary published pages through the ccpcaCreatePage AJAX action. This flaw can lead to unauthorized content creation on a WordPress site, potentially compromising the integrity and security of the web application.

References