Ally Web Accessibility: Unauthenticated SQL Injection (CVE-2026-2413)
The Ally Web Accessibility plugin for WordPress is vulnerable to unauthenticated time-based blind SQL injection in the get_global_remediations() method.
CVE search metadata
CVE search record: CVE-2026-2413. Severity: high. CVSS: 7.5. EPSS: 2.33%. KEV: no. Product: Ally Web Accessibility (<= 4.0.3). Brief: Ally Web Accessibility: Unauthenticated SQL Injection (CVE-2026-2413). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2026-2413/
Triage facts
Revision 1- Applicability
- Ally Web Accessibility (<= 4.0.3)
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 24, 06:08 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
A public exploit is available for CVE-2026-2413, an unauthenticated SQL injection vulnerability affecting the Ally Web Accessibility & Usability plugin for WordPress in versions up to and including 4.0.3. The flaw exists in the get_global_remediations() method due to improper sanitization of user-supplied URL parameters. Successful exploitation allows for time-based blind SQL injection, provided the Remediation module is active and connected to an Elementor account.