CVE-2025-13309

MediumCVSS 4.3

Published: 06/12/2025(UTC)Updated: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The Accessiy By CodeConfig Accessibility plugin for WordPress (versions up to and including 1.0.2) is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. Authenticated attackers with subscriber-level access and above can modify the plugin's global accessibility settings.

Risk Assessment

An attacker with low privileges can change accessibility settings, potentially causing accessibility issues or misleading users.

Recommendation

Update the Accessiy By CodeConfig Accessibility plugin to a version newer than 1.0.2. Check if accessibility settings have been altered.

Other vulnerabilities in Accessiy By CodeConfig Accessibility

CVE-2025-13358Medium
The Accessiy By CodeConfig Accessibility plugin for WordPress (versions up to and including 1.0.0) is vulnerable to unauthorized page creation due to missing authorization checks in the Settings::createPage() function. Authenticated attackers with Subscriber-level access and above can create arbitrary published pages via the ccpcaCreatePage AJAX action.

Original NVD description (English source)

The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers with subscriber-level access and above to modify the plugin’s global accessibility settings.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS