Missing authorization in Ability, Inc.'s Accessibility Suite plugin allows attackers to exploit incorrect access control, granting them unauthorized access to plugin functions or data that should be restricted. The vulnerability is a CWE‑862 missing authorization weakness, and the impact includes unauthorized read or modification of plugin configuration, potentially compromising the site’s confidentiality and integrity. Based on typical security consequences of missing authorization, it is inferred that the attacker could read or modify plugin configuration, affecting confidentiality and integrity.

The vulnerability affects the WordPress Accessibility Suite plugin, version 4.18 and earlier, developed by Ability, Inc. All installations of that plugin running those versions are impacted.

The CVSS score of 6.3 signals medium severity while the EPSS score of <1% indicates a very low likelihood of exploitation as of current data. The plugin is publicly accessible and the description indicates exploitation through incorrectly configured access control, so it is inferred that the attack vector is remote via the public web interface. Exploitation requires no privileged account and is not listed in the CISA KEV catalog.