Authorization Bypass in Equalize Digital Accessibility Checker Plugin for WordPress

CVE-2026-9015

What is CVE-2026-9015?

The Equalize Digital Accessibility Checker plugin for WordPress is susceptible to an authorization bypass vulnerability found in all versions up to and including 1.42.0. This vulnerability arises because the plugin fails to properly validate user permissions for specific actions. As a result, authenticated attackers with subscriber-level access and above can alter the ignore state, reason, and comments related to accessibility issues site-wide, including mass changes across all entries sharing a singular object identifier when largeBatch=true is enabled. This compromises the integrity of accessibility audits by allowing unauthorized modifications to be hidden or dismissed.

References