CVE-2026-3773 is an SQL Injection vulnerability in the Accessibility Suite by Ability, Inc WordPress plugin affecting versions up to 4.20. The issue is caused by improper neutralization of special elements in the 'scan_id' parameter, allowing authenticated users with low privileges (Subscriber-level and above) to inject additional SQL commands. This vulnerability can lead to unauthorized disclosure of sensitive information from the database. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker with Subscriber-level access or higher can exploit this vulnerability to execute unauthorized SQL queries, potentially extracting sensitive data from the database. The vulnerability does not allow modification or destruction of data (no integrity or availability impact reported), but confidentiality is impacted. This could lead to exposure of sensitive information stored in the database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to the 'scan_id' parameter. Avoid exposing this parameter unnecessarily and consider implementing additional input validation or web application firewall rules to detect and block SQL injection attempts targeting this parameter.