CVE-2025-13358: Accessiy Plugin Auth Bypass Vulnerability

CVE-2025-13358 Overview

CVE-2025-13358 affects the Accessiy By CodeConfig Accessibility plugin for WordPress in versions up to and including 1.0.0. The plugin fails to perform capability checks in the Settings::createPage() function exposed through the ccpcaCreatePage AJAX action. Authenticated users with Subscriber-level access or higher can invoke this action to create arbitrary published pages on the site. The flaw is classified as Missing Authorization [CWE-862] and stems from an absent permission check on a state-changing endpoint.

Critical Impact
Any authenticated low-privileged WordPress user can publish arbitrary pages, enabling content defacement, SEO spam, and phishing lure injection on the target site.

Affected Products

Accessiy By CodeConfig Accessibility plugin for WordPress, versions up to and including 1.0.0
WordPress sites running the vulnerable plugin with open registration or existing Subscriber accounts
Multi-author WordPress installations exposing the admin-ajax.php endpoint to authenticated users

Discovery Timeline

2025-12-06 - CVE-2025-13358 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13358

Vulnerability Analysis

The Accessiy By CodeConfig Accessibility plugin registers an AJAX handler named ccpcaCreatePage that maps to the Settings::createPage() method. This handler creates and publishes new WordPress pages using the request parameters supplied by the caller. The handler is registered under wp_ajax_*, which restricts it to authenticated users but does not distinguish between roles.

The function omits a current_user_can() capability check before invoking wp_insert_post() or its equivalent. As a result, any authenticated session, including the default Subscriber role, satisfies the only gate protecting the endpoint. The plugin also does not verify the intended workflow context that would normally require edit_pages or publish_pages capabilities.

The vulnerability is confirmed to affect the code paths in includes/Ajax.php line 24 and includes/Ajax/Settings.php line 96, per the WordPress Plugin Ajax.php Source and WordPress Plugin Settings.php Source.

Root Cause

The root cause is a missing authorization control on a privileged AJAX action. The plugin conflates authentication with authorization by relying solely on the wp_ajax_ registration to protect an operation that should require the publish_pages capability. No nonce validation combined with capability enforcement is present in the vulnerable function.

Attack Vector

An attacker first obtains any authenticated WordPress account, typically through self-registration on sites where registration is enabled. The attacker then sends a POST request to /wp-admin/admin-ajax.php with action=ccpcaCreatePage and controlled page content parameters. WordPress accepts the request because a valid session cookie is present, and the plugin publishes the attacker-controlled page without further checks.

The published page can be used to host SEO spam, malicious redirects, phishing forms, or defacement content that appears under the legitimate site's domain and trust context. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-13358

Indicators of Compromise

Unexpected published pages in the wp_posts table with post_status='publish' and post_type='page' authored by Subscriber-level accounts
Access log entries showing POST requests to /wp-admin/admin-ajax.php with the parameter action=ccpcaCreatePage
New WordPress user registrations followed shortly by AJAX requests targeting the ccpcaCreatePage action
Sudden appearance of pages containing external links, redirects, or content unrelated to the site's normal editorial output

Detection Strategies

Query the WordPress database for pages authored by users whose role is subscriber or contributor, which typically should not own published pages
Monitor web server logs for requests to admin-ajax.php containing ccpcaCreatePage and correlate the source IP with newly registered accounts
Alert on any invocation of the ccpcaCreatePage action from user sessions lacking the edit_pages capability

Monitoring Recommendations

Enable WordPress audit logging to capture post_type=page creation events with the originating user ID and role
Forward web server and WordPress audit logs to a centralized SIEM for correlation between user registration and privileged AJAX actions
Track baselines for daily page creation counts and alert on statistically significant deviations

How to Mitigate CVE-2025-13358

Immediate Actions Required

Deactivate the Accessiy By CodeConfig Accessibility plugin on all WordPress sites running version 1.0.0 or earlier until a patched release is confirmed installed
Audit the wp_posts table for unauthorized pages created since the plugin was installed and remove or unpublish suspicious entries
Disable open user registration under Settings > General, or restrict the default role to a role with no session privileges if registration is required
Rotate credentials and review the user list for suspicious Subscriber accounts created during the exposure window

Patch Information

A code change addressing this issue is tracked in WordPress Changeset #3411529. Site administrators should update the Accessiy By CodeConfig Accessibility plugin to a version later than 1.0.0 that incorporates this changeset. Review the Wordfence Vulnerability Report for current fixed-version guidance.

Workarounds

Block requests to admin-ajax.php where action=ccpcaCreatePage at the web application firewall or reverse proxy layer
Use a role management plugin to remove all capabilities from the Subscriber role beyond read and prevent role escalation
Restrict access to /wp-admin/admin-ajax.php to authenticated administrator IP ranges where operationally feasible

bash

# Example: block the vulnerable AJAX action at nginx
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "ccpcaCreatePage") {
        return 403;
    }
    if ($request_body ~* "action=ccpcaCreatePage") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}