On April 16 2026, the Accessibility Suite plugin for WordPress was flagged as vulnerable to SQL injection via the scan_id parameter. This flaw could let authenticated users with Subscriber-level access extract sensitive data from your database.
What We Know
The vulnerability is identified as CVE-2026-3773 and was published on April 16 2026, 6:16 a.m. All versions up to, and including, 4.20 of the plugin are affected. The issue stems from insufficient escaping on the user-supplied scan_id parameter and a lack of proper preparation on the existing SQL query. Attackers can append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The severity is 6.5 (Medium).
News Source
Business Impact
- SMBs: If your WordPress site hosts customer data, financial records or personal details, a malicious user could pull this information out of the database. This may lead to reputational damage and potential regulatory penalties (e.g., GDPR violations).
- Enterprises: In larger organizations with complex databases, a breach could expose confidential corporate data, trade secrets, or employee records. The impact could be costly in terms of legal liabilities, loss of business continuity, and competitive disadvantage.
What to Do
- Upgrade the plugin – install version 4.21 or newer immediately.
- If upgrading is not feasible, disable or restrict access to the
scan_idfeature for non-critical users. - Monitor logs – look for anomalous SQL queries or unusual database activity that could indicate exploitation.
- Conduct a security scan of your WordPress installation and any associated databases.
- Consider migrating to a more secure platform if the plugin’s vulnerabilities persist.
The Bigger Picture
WordPress plugins frequently contain vulnerabilities, especially those that handle user input. Regularly updating plugins and employing automated security scanning tools can help mitigate such risks. Keeping an inventory of all installed plugins and their versions is essential for proactive risk management.
How We Can Help
DefendMyBusiness collaborates with over 400 technology providers to help organizations identify the right security solutions. For a quick assessment, you can use our free security scan tool or reach out at https://defendmybusiness.com/contact.
Sources
