Is CVE-2026-9199 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9199 being exploited in the wild.

How severe is CVE-2026-9199?

Medium severity, with a CVSS score of 4.3, published 18 June 2026.

Which products and versions are affected?

Equalize Digital Accessibility Checker up to, and including, 1.42.1.

Is there a fix for CVE-2026-9199?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9199 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9199?

Check whether you run Equalize Digital Accessibility Checker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9199: Equalize Digital Accessibility Checker authorization bypass in REST API

CVE-2026-9199 · Severity: medium · CVSS 4.3 · Published 2026-06-18

The Equalize Digital Accessibility Checker plugin for WordPress, which helps websites maintain compliance with accessibility standards, contains a security flaw in how it handles user permissions. An authorized user with 'Author' level access can bypass security checks to modify or dismiss accessibility audit records for posts they do not own, including those created by administrators. This could allow a malicious user to hide accessibility failures across the entire website, potentially leading to compliance risks or operational misinformation.

Technologies: Equalize Digital Accessibility Checker. Vendors: Equalize Digital.

Quick answers

Is CVE-2026-9199 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9199 being exploited in the wild.
How severe is CVE-2026-9199?: Medium severity, with a CVSS score of 4.3, published 18 June 2026.
Which products and versions are affected?: Equalize Digital Accessibility Checker up to, and including, 1.42.1.
Is there a fix for CVE-2026-9199?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9199 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9199?: Check whether you run Equalize Digital Accessibility Checker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as a missing authorization check (CWE-862) within the plugin's REST API handler. Authenticated attackers with Author-level privileges can exploit this by submitting a request to dismiss, ignore, or restore accessibility issues. By including the 'largeBatch=true' parameter and referencing an issue ID from a post they own, the attacker can trigger a bulk-modification process that affects all matching issues across the site, regardless of post ownership. This allows the modification of records belonging to administrator-owned content. The issue is present in all versions up to and including 1.42.1.

Affected products

Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance up to, and including, 1.42.1

Timeline

2026-06-18: disclosed
2026-06-18: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.