The Ally – Web Accessibility & Usability WordPress plugin is vulnerable to SQL Injection via the URL path. User input is concatenated directly into an SQL JOIN clause without proper sanitization, allowing an attacker to inject SQL metacharacters. This results in a time‑based blind injection that can extract sensitive data from the database, providing a clear pathway for unauthorized information disclosure. The weakness is classified as CWE‑89.

All versions of the Ally – Web Accessibility & Usability plugin up to and including 4.0.3 are impacted. The vulnerability exists when the Remediation module is active, which requires the plugin to be connected to an Elementor account. No other vendors or products are listed as affected.

The CVSS score of 7.5 indicates a moderate to high severity, and the EPSS score of 15% suggests a non-negligible chance of exploitation. The vulnerability is not present in the CISA KEV catalog. Attackers can exploit the flaw via unauthenticated HTTP requests to the plugin’s URL path, bypassing any credential checks. Given the lack of authentication requirement and the potential for data exfiltration, the risk to affected sites is significant.