We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance Plugin Vulnerability (CVE-2026-9015)

Nick Paliughi
On this page

Security Alert Summary

The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress contains an authorization bypass that allows authenticated users with subscriber-level access and above to modify the ignore state, ignore reason, and ignore comment of accessibility issues across the site. Attackers can supply a largeBatch=true parameter to perform mass modifications affecting all rows sharing an object identifier, which can corrupt accessibility audit integrity by hiding or dismissing findings outside the user’s authorization scope.

CVE Details

  • CVE ID: CVE-2026-9015
  • Affected component: Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress
  • Affected versions: All versions up to and including 1.42.0
  • Published: May 28, 2026 at 9:16:49 AM
  • Last modified: May 28, 2026 at 1:45:25 PM
  • CVSS v3.1: Base Score 4.3, MEDIUM — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
  • Authentication / Privileges / User interaction: Authentication required (authenticated users). Privileges required: Low (subscriber-level and above). User interaction: None.
  • Primary impact: Confidentiality: None. Integrity: Low (unauthorized modification of accessibility audit data). Availability: None.
  • Weakness: CWE-862 (authorization bypass)

Technical Details

The vulnerability is an authorization bypass caused by the plugin failing to properly verify that the acting user is permitted to change the state of accessibility findings. Authenticated users with subscriber-level access and higher can modify the ignore state, ignore reason, and ignore comment fields for arbitrary accessibility issues across the site.

The issue allows mass modification when the parameter largeBatch=true is supplied, which causes all rows sharing an “object” identifier to be modified together. This behavior can be used to hide or dismiss findings outside a user’s authorization scope, corrupting the integrity of accessibility audits and reports.

Code references in the disclosure point to the plugin’s admin-side AJAX handling (see references to admin/class-ajax.php in the provided links), indicating the problematic checks occur in server-side request handlers used by authenticated users. The core cause is missing or insufficient authorization checks for actions that alter audit records.

How This Could Impact Your Website

On a typical site with multiple users, the site owner and administrators rely on accessibility audit data to track issues and coordinate fixes. Internal staff such as editors or content authors, and external contractors or contributors with subscriber-level access, could unintentionally or deliberately modify audit entries they should not control. Practical consequences include:

  • Audit records being altered to hide or dismiss accessibility findings, making audits unreliable.
  • Missed remediation work because issues are marked ignored or comments altered, potentially delaying fixes and exposing the site to compliance or usability concerns.
  • Increased administrative overhead to verify and rebuild accurate audit data after unauthorized changes.

If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles and capabilities, especially for contributors and subscriber-level accounts.
  • Enforce strong passwords and enable two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins to reduce your attack surface.
  • Monitor site activity and audit logs for unusual changes to accessibility findings or mass modifications.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
Visualizer: Tables and Charts Manager for WordPress Plugin Vulnerability (CVE-2026-8689)
Next Post
PeachPay   Plugin Vulnerability (CVE-2026-9618)