# CVE-2026-9015: Equalize Digital Accessibility Checker authorization bypass in AJAX handlers

Source: https://junglewise.ai/threats/cve-2026-9015-equalize-digital-accessibility-checker-authorization-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-9015 · Severity: medium · CVSS 4.3 · Published 2026-05-28

The Equalize Digital Accessibility Checker plugin for WordPress, which helps websites maintain compliance with accessibility laws, contains a security flaw that allows low-level users to bypass authorization. An authenticated attacker with basic subscriber access can modify or dismiss accessibility audit findings across the entire website. This can compromise the integrity of compliance reports by hiding actual accessibility issues from site administrators.

Technologies: [Equalize Digital Accessibility Checker](https://junglewise.ai/threats/technologies/accessibility-checker). Vendors: [Equalize Digital](https://junglewise.ai/threats/vendors/equalize-digital).

## Quick answers

**Is CVE-2026-9015 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9015 being exploited in the wild.

**How severe is CVE-2026-9015?** Medium severity, with a CVSS score of 4.3, published 28 May 2026.

**Which products and versions are affected?** Equalize Digital Accessibility Checker Up to, and including, 1.42.0.

**Is there a fix for CVE-2026-9015?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9015 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9015?** Check whether you run Equalize Digital Accessibility Checker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Equalize Digital Accessibility Checker plugin for WordPress suffers from a missing authorization check (CWE-862) in its AJAX handlers. Specifically, the plugin fails to verify user permissions before allowing modifications to the 'ignore' state, reasons, and comments of accessibility issues. An authenticated attacker with subscriber-level privileges or higher can send crafted requests to modify arbitrary audit findings. By supplying the 'largeBatch=true' parameter, an attacker can perform mass modifications of all rows sharing an 'object' identifier, effectively corrupting the integrity of the site's accessibility audit. The vulnerability is present in versions up to and including 1.42.0 and was addressed in subsequent updates.

## Affected products

- Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance Up to, and including, 1.42.0

## Timeline

- 2026-05-28: disclosed
- 2026-05-28: advisory

## References

- [https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.38.0/admin/class-ajax.php](https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.38.0/admin/class-ajax.php)
- [https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.38.0/admin/class-ajax.php](https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.38.0/admin/class-ajax.php)
- [https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.38.0/admin/class-ajax.php](https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.38.0/admin/class-ajax.php)
- [https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.38.0/admin/class-enqueue-admin.php](https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.38.0/admin/class-enqueue-admin.php)
- [https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.41.0/admin/class-ajax.php](https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.41.0/admin/class-ajax.php)
- [https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.41.0/admin/class-ajax.php](https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.41.0/admin/class-ajax.php)
- [https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.41.0/admin/class-ajax.php](https://plugins.trac.wordpress.org/browser/accessibility-checker/tags/1.41.0/admin/class-ajax.php)

## Related threats

- [Equalize Digital Accessibility Checker Stored XSS in html parameter](https://junglewise.ai/threats/cve-2026-14481-equalize-digital-accessibility-checker-stored-xss-in-html)
- [Equalize Digital Accessibility Checker authorization bypass in REST API](https://junglewise.ai/threats/cve-2026-9199-equalize-digital-accessibility-checker-authorization-bypass-in)