Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations()` method, where it is directly concatenated into an SQL JOIN clause without proper sanitization for SQL context. While `esc_url_raw()` is applied for URL safety, it does not prevent SQL metacharacters (single quotes, parentheses) from being injected. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection techniques. The Remediation module must be active, which requires the plugin to be connected to an Elementor account.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2413
- 2026-10-03 Alias added: GHSA-83wr-6xhc-8r8r
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/00e070b7-bdf6-4a80-a3ee-628243f1cc25?source=cve
- https://plugins.trac.wordpress.org/browser/pojo-accessibility/tags/4.0.3/modules/remediation/database/remediation-entry.php#L215
- https://plugins.trac.wordpress.org/browser/pojo-accessibility/tags/4.0.3/modules/remediation/classes/utils.php#L17
- https://plugins.trac.wordpress.org/changeset/3467513/pojo-accessibility/trunk/modules/remediation/database/remediation-entry.php
More Elementor vulnerabilities
- TI-2022-01211 Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution CVSS 3.1HIGH 8.8
- TI-2023-00313 Elementor Website Builder < 3.12.2 - Admin+ SQLi CVSS 3.1HIGH 7.2
- TI-2026-06653 Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover CVSS 3.1CRITICAL 9.8
- TI-2023-02927 Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option CVSS 3.1HIGH 8.8
- TI-2020-10317 An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as… CVSS 3.1CRITICAL 9.9
- TI-2023-25675 WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-2413 · CVE Program
- CVE-2026-2413 · NVD
- FIRST EPSS
- GHSA-83wr-6xhc-8r8r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences