Ally Web Accessibility (<= 4.0.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ally-web-accessibility--4.0.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 06:08:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAlly Web Accessibility: Unauthenticated SQL Injection (CVE-2026-2413)https://feed.craftedsignal.io/briefs/2026-10-cve-2026-2413/Sat, 24 Oct 2026 06:08:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2026-2413/The Ally Web Accessibility plugin for WordPress is vulnerable to unauthenticated time-based blind SQL injection in the get_global_remediations() method.A public exploit is available for CVE-2026-2413, an unauthenticated SQL injection vulnerability affecting the Ally Web Accessibility & Usability plugin for WordPress in versions up to and including 4.0.3. The flaw exists in the get_global_remediations() method due to improper sanitization of user-supplied URL parameters. Successful exploitation allows for time-based blind SQL injection, provided the Remediation module is active and connected to an Elementor account.

]]>highadvisoryweb-vulnerabilitysqliwordpressplugin