CVE-2026-3773

Name of the Vulnerable Software and Affected Versions Accessibility Suite by Ability, Inc versions prior to 4.21

Description The Accessibility Suite by Ability, Inc plugin for WordPress contains a flaw allowing authenticated attackers with Subscriber-level access or higher to perform SQL Injection. This occurs because the scan id parameter is not properly escaped and the SQL query is not sufficiently prepared, enabling the execution of additional queries to extract sensitive information from the database.

Recommendations Update the plugin to a version later than 4.20. As a temporary workaround, restrict access to the scan id parameter until the update is applied.