Junglewise Threat Intelligence

CVE-2026-9199: Equalize Digital Accessibility Checker authorization bypass in REST API

CVE-2026-9199 · Severity: medium · CVSS 4.3 · Published 2026-06-18

Technologies: Equalize Digital Accessibility Checker. Vendors: Equalize Digital.

Executive brief

The Equalize Digital Accessibility Checker plugin for WordPress, which helps websites maintain compliance with accessibility standards, contains a security flaw in how it handles user permissions. An authorized user with 'Author' level access can bypass security checks to modify or dismiss accessibility audit records for posts they do not own, including those created by administrators. This could allow a malicious user to hide accessibility failures across the entire website, potentially leading to compliance risks or operational misinformation.

Technical details

The vulnerability is classified as a missing authorization check (CWE-862) within the plugin's REST API handler. Authenticated attackers with Author-level privileges can exploit this by submitting a request to dismiss, ignore, or restore accessibility issues. By including the 'largeBatch=true' parameter and referencing an issue ID from a post they own, the attacker can trigger a bulk-modification process that affects all matching issues across the site, regardless of post ownership. This allows the modification of records belonging to administrator-owned content. The issue is present in all versions up to and including 1.42.1.

Affected products

  • Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance up to, and including, 1.42.1

Timeline

  • 2026-06-18: disclosed
  • 2026-06-18: advisory

References

Related threats