CVE-2025-49920

MediumCVSS 5.4

Published: 22/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

The Web Accessibility By accessiBe plugin (versions up to 2.10) has a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.

Risk Assessment

An attacker could gain access to functions or data they are not authorized to access. This may lead to unauthorized changes or information disclosure.

Recommendation

Update the plugin to a version higher than 2.10. Review and correct access control configuration.

Other vulnerabilities in Web Accessibility By accessiBe

CVE-2025-10375Medium
The Web Accessibility By accessiBe plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.10. Missing nonce validation on multiple AJAX actions allows unauthenticated attackers to modify plugin settings and create verification files via forged requests.

Original NVD description (English source)

Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through <= 2.10.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS