The Equalize Digital Accessibility Checker plugin for WordPress contains an authorization bypass flaw that allows any authenticated user with at least subscriber-level privileges to invoke the edac_insert_ignore_data AJAX action without proper permission checks. This flaw permits the attacker to alter the ignore state, reason, and comment fields of any accessibility issue, and when largeBatch=true is used, to mass‑modify all issues sharing the same object identifier. The result is a deliberate corruption of audit data, potentially masking non‑compliant elements and undermining the integrity of WCAG, ADA, EAA and Section 508 assessments. The weakness is a classic authorization bypass (CWE‑862).

The vulnerability affects all installations of the Equalize Digital Accessibility Checker plugin on WordPress up to and including version 1.42.0. Any WordPress site that has this plugin active and whose users possess subscriber‑level or higher roles is within scope. No other vendors or products are impacted.

With a CVSS score of 4.3, the flaw presents a moderate threat level. Exploitation requires the attacker to be logged into the site as a subscriber or higher, which is a common scenario for users with minimal privileges; no external network attack vector is needed. EPSS data is currently unavailable, so the exploitation probability cannot be quantified beyond the requirement of authentication. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploit activity at the time of analysis.