CVE-2026-3773: WordPress Accessibility Suite SQL Injection

CVE-2026-3773 Overview

The Accessibility Suite by Ability, Inc plugin for WordPress contains a SQL Injection vulnerability in the scan_id parameter affecting all versions up to and including 4.20. This security flaw arises from insufficient escaping of user-supplied input and inadequate preparation of SQL queries, allowing authenticated attackers with Subscriber-level access or higher to inject malicious SQL statements into existing database queries.

Critical Impact

Authenticated attackers can extract sensitive information from the WordPress database, potentially including user credentials, personal data, and site configuration details.

Affected Products

• Accessibility Suite by Ability, Inc WordPress Plugin versions up to and including 4.20
• WordPress sites with the Online Accessibility plugin installed
• WordPress installations with Subscriber or higher user roles enabled

Discovery Timeline

• April 16, 2026 - CVE-2026-3773 published to NVD
• April 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3773

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists within the Accessibility Suite plugin's handling of the scan_id parameter. The vulnerable code path can be traced through the plugin's AJAX functions, specifically in the false-positives handling functionality. When processing requests, the plugin fails to properly sanitize user input before incorporating it into SQL queries.

The vulnerability allows authenticated users with minimal privileges (Subscriber-level) to manipulate database queries. This is particularly concerning because WordPress sites often allow public user registration with Subscriber roles by default, significantly expanding the potential attack surface.

Root Cause

The root cause of this vulnerability is twofold: insufficient escaping of the user-supplied scan_id parameter and the lack of proper prepared statements in the SQL query construction. The vulnerable code in false-positives.php accepts the scan_id parameter and passes it to helper functions without adequate sanitization. The Helper.php class then incorporates this unsanitized input directly into SQL queries, creating a classic SQL injection vulnerability.

Proper use of WordPress's $wpdb->prepare() method would prevent this vulnerability by parameterizing queries and escaping user input appropriately.

Attack Vector

The attack is conducted over the network by authenticated users targeting the vulnerable AJAX endpoint. An attacker would:

1. Authenticate to the WordPress site with at least Subscriber-level privileges
2. Craft a malicious request to the affected AJAX handler
3. Inject SQL statements through the scan_id parameter
4. Extract sensitive data from the database through error-based, time-based, or UNION-based SQL injection techniques

The vulnerability requires no user interaction beyond the attacker's own actions and targets the confidentiality of database contents. While the immediate impact is information disclosure, extracted credentials could lead to further compromise.

For technical details on the vulnerable code paths, see the WordPress Plugin Code Review and the Helper Class implementation.

Detection Methods for CVE-2026-3773

Indicators of Compromise

• Unusual AJAX requests to the Accessibility Suite plugin endpoints containing SQL syntax in the scan_id parameter
• Database query logs showing unexpected or malformed queries originating from the plugin
• Error logs indicating SQL syntax errors from the false-positives.php or Helper.php files
• Anomalous data extraction patterns or large result sets from plugin-related queries

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection patterns targeting WordPress AJAX endpoints
• Implement database activity monitoring to detect unusual query patterns or unauthorized data access
• Review WordPress user activity logs for suspicious behavior from Subscriber-level accounts
• Deploy intrusion detection rules targeting common SQL injection payloads in POST parameters

Monitoring Recommendations

• Enable comprehensive logging for WordPress AJAX requests, particularly those involving the Online Accessibility plugin
• Configure alerts for SQL injection signatures in web server access and error logs
• Monitor database query execution times for potential time-based blind SQL injection attempts
• Track failed and successful authentication events to identify potential attacker reconnaissance

How to Mitigate CVE-2026-3773

Immediate Actions Required

• Update the Accessibility Suite by Ability, Inc plugin to the latest patched version immediately
• Audit WordPress user accounts and remove unnecessary Subscriber-level access until the patch is applied
• Implement web application firewall rules to block SQL injection attempts targeting the vulnerable endpoint
• Review database access logs for any signs of prior exploitation

Patch Information

Administrators should check the WordPress plugin repository for an updated version of the Accessibility Suite plugin that addresses this SQL Injection vulnerability. The fix should implement proper use of WordPress's $wpdb->prepare() method for all database queries involving user input. For detailed vulnerability information and patch status, consult the Wordfence Vulnerability Report.

Workarounds

• Disable or deactivate the Accessibility Suite plugin until a patch is available if the functionality is not critical
• Restrict user registration and remove Subscriber-level accounts that do not require access
• Implement network-level access controls to limit plugin AJAX endpoint access to trusted IP addresses
• Deploy a web application firewall with SQL injection protection enabled

# Disable the vulnerable plugin via WP-CLI until patched
wp plugin deactivate online-accessibility

# Audit current user roles
wp user list --role=subscriber --fields=ID,user_login,user_email

# Enable WordPress debug logging for monitoring
wp config set WP_DEBUG true --raw
wp config set WP_DEBUG_LOG true --raw