CVE-2025-13358

MediumCVSS 5.3

Published: 06/12/2025(UTC)Updated: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

The Accessiy By CodeConfig Accessibility plugin for WordPress (versions up to and including 1.0.0) is vulnerable to unauthorized page creation due to missing authorization checks in the Settings::createPage() function. Authenticated attackers with Subscriber-level access and above can create arbitrary published pages via the ccpcaCreatePage AJAX action.

Risk Assessment

An attacker with low privileges can create unwanted content on the site, potentially leading to spam, misinformation, or damage to the site's reputation.

Recommendation

Update the Accessiy By CodeConfig Accessibility plugin to a version newer than 1.0.0. Check for and remove any unauthorized pages that may have been created.

Other vulnerabilities in Accessiy By CodeConfig Accessibility

CVE-2025-13309Medium
The Accessiy By CodeConfig Accessibility plugin for WordPress (versions up to and including 1.0.2) is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. Authenticated attackers with subscriber-level access and above can modify the plugin's global accessibility settings.

Original NVD description (English source)

The Accessiy By CodeConfig Accessibility plugin for WordPress is vulnerable to unauthorized page creation due to missing authorization checks in versions up to, and including, 1.0.0. This is due to the plugin not performing capability checks in the `Settings::createPage()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published pages on the site via the `ccpcaCreatePage` AJAX action.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS