The Accessiy By CodeConfig Accessibility plugin for WordPress contains a missing capability check in the Settings::createPage() function, allowing authenticated attackers with Subscriber-level privileges or higher to create arbitrary published pages through the ccpcaCreatePage AJAX action. This represents a Missing Authorization weakness (CWE‑862). By creating pages without authorization, an attacker can host malicious content such as phishing pages, inject spam, or otherwise alter the site’s public-facing structure, compromising integrity and potentially leading to defacement or credential theft.

Any WordPress site that has installed the Accessiy By CodeConfig Accessibility plugin version 1.0.0 or earlier. The vendor is CodeConfig and the affected product is the Accessibility Widgets plugin, affecting sites that run WordPress with this plugin active.

The vulnerability has a CVSS score of 5.3, indicating medium severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation at this time, and it is not listed in CISA’s KEV catalog. The attack vector requires an authenticated session with Subscriber-level access or higher; the attacker can exploit the exposed AJAX endpoint, ccpcacreatePage, to create pages. In practice, if an attacker can log in to the WordPress installation, they can leverage this capability to inject arbitrary content, raising risks to site integrity and user trust.