CVE-2025-13358

MEDIUM

WordPress Accessibility Plugin <1.0.0 - Privilege Escalation

Title source: llm

Description

The Accessiy By CodeConfig Accessibility plugin for WordPress is vulnerable to unauthorized page creation due to missing authorization checks in versions up to, and including, 1.0.0. This is due to the plugin not performing capability checks in the `Settings::createPage()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published pages on the site via the `ccpcaCreatePage` AJAX action.

References (6)

Core 6

Core References

https://plugins.trac.wordpress.org/changeset/3411529/

Product

https://plugins.trac.wordpress.org/browser/codeconfig-accessibility/tags/1.0.0/includes/Ajax.php#L24

Product

https://plugins.trac.wordpress.org/browser/codeconfig-accessibility/tags/1.0.0/includes/Ajax/Settings.php#L96

Product

https://plugins.trac.wordpress.org/browser/codeconfig-accessibility/trunk/includes/Ajax.php#L24

Product

https://plugins.trac.wordpress.org/browser/codeconfig-accessibility/trunk/includes/Ajax/Settings.php#L96

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/fe324d4d-eb52-4eeb-ad91-072a6e84d9ba?source=cve

Scores

CVSS v3 5.3

EPSS 0.0024

EPSS Percentile 15.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

codeconfig/Accessiy by CodeConfig – Accessibility Widgets for ADA, EAA & WCAG Compliance < 1.0.0

codeconfig/CodeConfig Accessibility < 1.0.0

Published Dec 06, 2025

Tracked Since Feb 18, 2026