CVE-2025-58976: Accessibility Checker Auth Bypass Flaw

CVE-2025-58976 is an authorization bypass vulnerability in Accessibility Checker by Equalize Digital affecting versions up to 1.31.0. Attackers can exploit misconfigured access controls to gain unauthorized access. This article covers technical details, affected versions, security impact, and recommended mitigation strategies.

CVE-2025-58976 Overview

CVE-2025-58976 is a missing authorization vulnerability in the Equalize Digital Accessibility Checker plugin for WordPress. The flaw affects all versions up to and including 1.31.0. Authenticated attackers with low privileges can exploit incorrectly configured access control security levels to reach functionality they should not access. The vulnerability is tracked under CWE-862: Missing Authorization and stems from broken access control in plugin endpoints. The issue was published to the National Vulnerability Database on September 9, 2025.

Critical Impact
Authenticated users with low privileges can invoke plugin functions without proper authorization checks, leading to unauthorized information disclosure on affected WordPress sites.

Affected Products

Equalize Digital Accessibility Checker WordPress plugin, versions up to and including 1.31.0
WordPress sites running the vulnerable plugin with any authenticated user role
All hosting environments where the affected plugin version is installed

Discovery Timeline

2025-09-09 - CVE-2025-58976 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58976

Vulnerability Analysis

The Accessibility Checker plugin exposes functionality that fails to verify whether the requesting user has appropriate permissions. The plugin implements incorrectly configured access control security levels, meaning capability checks are either absent or evaluated against an insufficient role. Any authenticated WordPress user, including a Subscriber, can send requests to the affected endpoints and receive data intended for higher-privileged roles.

The vulnerability is network-exploitable with low attack complexity and does not require user interaction. The impact is limited to confidentiality; integrity and availability are unaffected. This aligns with the plugin returning readable data to unauthorized callers rather than allowing modification.

Root Cause

The root cause is a missing authorization check ([CWE-862]) in plugin request handlers. WordPress plugins are expected to call current_user_can() with an appropriate capability before executing privileged operations. In the affected versions, this verification is either omitted or uses a capability that every authenticated role satisfies. Nonce validation alone does not enforce authorization, so authenticated users can craft valid requests and bypass intended access boundaries.

Attack Vector

An attacker first obtains any authenticated WordPress session on a target site running the affected plugin. This can be a self-registered Subscriber account on sites with open registration. The attacker then issues an HTTP request to the vulnerable plugin action or REST endpoint. Because the endpoint lacks a capability check, the server processes the request and returns data that should be restricted to Editors or Administrators. See the Patchstack Vulnerability Report for endpoint-level technical details.

No public proof-of-concept exploit is currently listed for this CVE, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-58976

Indicators of Compromise

Unexpected HTTP requests from low-privileged user sessions to Accessibility Checker admin-ajax.php actions or REST routes under /wp-json/accessibility-checker/
WordPress access logs showing Subscriber or Contributor accounts retrieving accessibility scan reports or site-wide audit data
New user registrations followed shortly by requests to plugin-specific endpoints

Detection Strategies

Inventory WordPress installations and identify sites running Accessibility Checker version 1.31.0 or earlier
Review web server logs for authenticated requests to plugin endpoints originating from non-administrative roles
Correlate WordPress authentication events with plugin endpoint access to identify privilege mismatches

Monitoring Recommendations

Enable verbose logging on wp-admin/admin-ajax.php and REST API routes exposed by the plugin
Alert on anomalous data volumes returned to low-privileged sessions
Track plugin version drift across managed WordPress fleets to detect unpatched instances

How to Mitigate CVE-2025-58976

Immediate Actions Required

Update the Equalize Digital Accessibility Checker plugin to a version later than 1.31.0 as soon as a fixed release is available from the vendor
Audit WordPress user accounts and remove unused low-privileged accounts that could be leveraged for exploitation
Disable open user registration on sites that do not require it to reduce the pool of authenticated attackers

Patch Information

Refer to the Patchstack Vulnerability Report for the latest fixed version guidance from Equalize Digital. Apply plugin updates through the WordPress dashboard or your managed hosting provider's update workflow.

Workarounds

Deactivate the Accessibility Checker plugin until a patched version is installed if immediate updating is not possible
Restrict access to /wp-admin/admin-ajax.php and plugin REST routes at the web application firewall layer for non-administrative roles
Enforce least-privilege user roles and require multi-factor authentication for all WordPress accounts

bash

# Example WP-CLI commands to check plugin version and deactivate if vulnerable
wp plugin get accessibility-checker --field=version
wp plugin deactivate accessibility-checker
wp plugin update accessibility-checker