# WP Accessibility <= 2.4.3 - Unauthenticated Sensitive Information Exposure via 'longdesc' Parameter

- **ID:** WPSEC-2026-1250
- **Plugin:** WP Accessibility (`wp-accessibility`), https://wordpress.org/plugins/wp-accessibility/
- **Affected versions:** all versions before 2.4.4
- **Fixed in:** 2.4.4 (Update to 2.4.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-20)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-accessibility
- **Fix released:** 2026-10-18
- **Published:** 2026-10-20
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1250/

## Description

The WP Accessibility plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'longdesc' and 'referrer' parameters in all versions up to, and including, 2.4.3. This is due to the public long description page loading any image attachment by ID and printing its title and description without checking whether the attachment, or the post it is attached to, is private, and printing the permalink of any post ID given in the 'referrer' parameter without checking that post's visibility. This makes it possible for unauthenticated attackers to enumerate IDs and read the titles and long descriptions of images attached to private posts, and to discover the permalinks of private posts.

## References

- https://wpsec.com/vuln/WPSEC-2026-1250/
- https://plugins.svn.wordpress.org/wp-accessibility/tags/2.4.4/
- https://wordpress.org/plugins/wp-accessibility/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1250/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.