The Web Accessibility By accessiBe WordPress plugin suffers a CSRF flaw in versions 2.10 and earlier due to the omission of nonce validation on several AJAX endpoints such as accessibe_signup, accessibe_login, accessibe_license_trial, accessibe_modify_config, and accessibe_add_verification_page. Because the requests can be forged without user credentials, an attacker can cause a site administrator to execute actions that change plugin configuration or add verification files with unauthorized content. This directly compromises the integrity of the plugin settings and could be leveraged to introduce malicious code into the site. The weakness is a traditional Cross‑Site Request Forgery (CWE‑352).

The affected system is the accessiBe Web Accessibility plugin for WordPress, inclusively all releases up to and including version 2.10. Users running these versions should review their installations to confirm the plugin version and ensure they are not using the compromised code. No other WordPress core or plugin components are reported to be impacted.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw requires no authentication, but it does rely on an administrator clicking a forged link or button, making attackers typically employ social engineering or phishing to trigger the vulnerable AJAX requests. While the vulnerability is not yet listed in CISA’s KEV catalog, the potential for undetected exploitation remains. Organizations should consider the risk especially if they rely heavily on the accessiBe plugin for website accessibility compliance.