---
id: CVE-2025-13309
title: >-
  The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility
  Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization
  bypass in versions up to, and including, 1.0.2
summary: >-
  The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility
  Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization
  bypass in versions up to, and including, 1.0.2. This is due to the plugin not
  properly…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
published: '2025-12-06'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T20:10:00.197'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13309'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/codeconfig-accessibility/trunk/includes/Ajax.php#L19
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/codeconfig-accessibility/trunk/includes/Ajax/Settings.php#L23
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/codeconfig-accessibility/trunk/includes/Enqueue.php#L135
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/f3344e72-1dd6-45ec-b699-d755589a1566?source=cve
    label: security@wordfence.com
tags:
  - nvd
epss: 0.00253
epssPercentile: 0.16745
ingestedAt: '2026-10-27T18:12:09.289Z'
---

## Overview

The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers with subscriber-level access and above to modify the plugin’s global accessibility settings.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.