WP Accessibility <= 2.4.3 - Unauthenticated Sensitive Information Exposure via 'longdesc' Parameter
- ID
- WPSEC-2026-1250
- Plugin
- WP Accessibility (wp-accessibility)
- Affected
- all versions before 2.4.4
- Remediation
- Update to 2.4.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-20
- Attack surface
- WP Accessibility on WPSec AttackSurface
- Fix released
- Published
Description
The WP Accessibility plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'longdesc' and 'referrer' parameters in all versions up to, and including, 2.4.3. This is due to the public long description page loading any image attachment by ID and printing its title and description without checking whether the attachment, or the post it is attached to, is private, and printing the permalink of any post ID given in the 'referrer' parameter without checking that post's visibility. This makes it possible for unauthenticated attackers to enumerate IDs and read the titles and long descriptions of images attached to private posts, and to discover the permalinks of private posts.
References
- https://wpsec.com/vuln/WPSEC-2026-1250/
- https://plugins.svn.wordpress.org/wp-accessibility/tags/2.4.4/
- https://wordpress.org/plugins/wp-accessibility/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS