CVE-2026-9199 describes an authorization bypass vulnerability (CWE-862) in the Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance WordPress plugin. The plugin fails to properly verify user authorization when performing actions on accessibility audit issue records. An attacker with author-level privileges can exploit this by using a crafted dismiss-issue request with the parameter largeBatch=true referencing an issue from their own post. This causes the plugin to bulk-modify all accessibility issues site-wide that share the same 'object' value, including those belonging to posts owned by administrators. This allows unauthorized modification of audit records beyond the attacker's permitted scope.

The vulnerability allows authenticated users with author-level access or higher to bypass authorization controls and bulk-modify accessibility audit issues across the entire site, including those related to posts they do not have permission to edit. This can lead to unauthorized dismissal, ignoring, or restoration of accessibility issues, potentially undermining the integrity of accessibility compliance records. There is no impact on confidentiality or availability reported, only integrity is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level user permissions if possible to limit exposure. Monitor for updates from the vendor equalizedigital regarding patches or official fixes. Avoid using the dismiss-issue functionality with the largeBatch=true parameter if feasible.