The Accessiy by CodeConfig – Accessibility Widgets for ADA, EAA & WCAG Compliance WordPress plugin suffers from an authorization bypass vulnerability (CWE-862) in versions up to and including 1.0.2. The plugin fails to properly verify that a user is authorized to perform certain actions, enabling authenticated users with subscriber-level privileges or higher to modify global accessibility settings. The CVSS 3.1 base score is 4.3 (medium severity) with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact.

Authenticated users with subscriber-level access or higher can modify global accessibility settings of the plugin without proper authorization. This could lead to unauthorized changes in accessibility configurations, potentially affecting website behavior or compliance with accessibility standards. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user capabilities where possible and monitor for unauthorized changes to accessibility settings. Avoid granting unnecessary privileges to users. Follow vendor updates for a patch or official mitigation.