CVE-2026-9199: WordPress Accessibility Checker Auth Bypass

CVE-2026-9199 Overview

CVE-2026-9199 is an authorization bypass vulnerability in the Equalize Digital Accessibility Checker plugin for WordPress. The plugin provides WCAG, ADA, EAA, and Section 508 compliance scanning. Affected versions include all releases up to and including 1.42.1. The flaw resides in the REST API handler that processes accessibility audit issue actions such as dismiss, ignore, and restore. The handler fails to verify that the requesting user owns the target post before applying changes site-wide. Authenticated users with author-level access can manipulate accessibility records on posts owned by administrators and other users.

Critical Impact
Author-level users can bulk-modify accessibility issue records across the entire site, including records tied to administrator-owned posts, by exploiting a missing authorization check ([CWE-862]).

Affected Products

Equalize Digital Accessibility Checker plugin for WordPress
All versions up to and including 1.42.1
WordPress sites granting author-level (or higher) access to untrusted users

Discovery Timeline

2026-06-18 - CVE-2026-9199 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-9199

Vulnerability Analysis

The vulnerability is an authorization bypass classified under [CWE-862] (Missing Authorization). The Accessibility Checker plugin exposes REST API endpoints that allow users to dismiss, ignore, or restore accessibility audit issue records associated with WordPress posts. The handler accepts an issue identifier from the caller and treats that identifier as proof that the caller is allowed to modify any matching record. When the largeBatch=true parameter is supplied, the handler expands the scope of the operation to every issue sharing the same object value across the entire site. The plugin does not re-check post ownership or edit_post capability against each affected record before applying the change.

Root Cause

The root cause is reliance on a user-supplied issue reference as an implicit authorization token. The REST API handler in class-rest-api.php (referenced at lines 349, 1232, and 1247 in tags 1.39.0 and 1.42.0) validates that the caller can access one issue, then performs bulk modifications on other issues without revalidating per-record permissions. The handler conflates "can act on this single issue" with "can act on every issue sharing this object value."

Attack Vector

An attacker requires an authenticated account with author-level capabilities or higher. The attacker first triggers an accessibility scan on a post they own to generate a legitimate issue record. They then submit a dismiss-issue, ignore-issue, or restore-issue REST API request referencing that issue and include largeBatch=true in the request payload. The handler executes the action against every site-wide issue sharing the same object value, including issues belonging to posts owned by administrators. The exploit does not require user interaction and operates over the network through standard WordPress REST endpoints.

No verified public proof-of-concept code is available. Technical details are documented in the Wordfence Vulnerability Report and the WordPress Accessibility Checker source.

Detection Methods for CVE-2026-9199

Indicators of Compromise

Unexpected changes to accessibility issue states (dismissed, ignored, or restored) on posts owned by administrators or editors
REST API requests to Accessibility Checker endpoints containing the largeBatch=true parameter from author-level accounts
Audit log entries showing bulk accessibility issue modifications initiated by non-administrative users

Detection Strategies

Monitor WordPress REST API access logs for requests to accessibility-checker routes that include largeBatch=true
Correlate the WordPress user role of the request initiator against the ownership of affected posts to surface cross-account modifications
Track sudden spikes in dismissed or ignored accessibility issues across multiple posts within a short time window

Monitoring Recommendations

Enable verbose REST API logging on WordPress and forward events to a centralized logging or SIEM platform
Alert on any author-level or contributor-level account interacting with Accessibility Checker endpoints in bulk-modify mode
Periodically diff the Accessibility Checker issue table against known-good baselines to detect unauthorized state changes

How to Mitigate CVE-2026-9199

Immediate Actions Required

Update the Equalize Digital Accessibility Checker plugin to a version newer than 1.42.1 as soon as a patched release is available
Audit existing user accounts and remove or downgrade author-level access for untrusted contributors
Review accessibility issue records for unauthorized state changes and restore as needed

Patch Information

The vendor committed code changes referenced in WordPress.org changeset 3553926 for the accessibility-checker plugin. Site administrators should upgrade beyond version 1.42.1 once the fixed release is published. Confirm patch status against the Wordfence advisory.

Workarounds

Restrict author-level and higher accounts to trusted users only until a patched plugin version is installed
Temporarily deactivate the Accessibility Checker plugin on multi-author sites where untrusted authors hold publishing privileges
Use a Web Application Firewall (WAF) rule to block REST API requests to accessibility-checker endpoints containing the largeBatch=true parameter from non-administrator sessions

bash

# Example WAF rule concept: block largeBatch=true on accessibility-checker REST routes
# Adjust syntax for your specific WAF (ModSecurity shown)
SecRule REQUEST_URI "@contains /wp-json/accessibility-checker/" \
  "chain,id:1029199,phase:2,deny,status:403,msg:'Block CVE-2026-9199 bulk modify'"
  SecRule ARGS:largeBatch "@streq true"