This vulnerability (CVE-2026-24537) affects WP Accessibility Helper (WAH) versions up to 0.6.6 and involves an unauthenticated Cross-Site Request Forgery (CWE-352). An attacker can trick a user into submitting a forged request that the plugin processes, potentially causing unintended state changes or actions. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction required. There is no vendor advisory or patch available at this time.

The vulnerability allows an attacker to induce a user to perform unintended actions on the affected plugin without authentication. While it does not impact confidentiality or availability, it can cause integrity issues by enabling unauthorized changes. The medium CVSS score reflects limited impact due to the need for user interaction and the lack of privilege requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the plugin or restricting access to trusted users only. Implementing additional CSRF protections at the application or web server level may help mitigate risk.