An unauthenticated SQL injection flaw (CVE-2026-2413) in the Ally WordPress plugin, used on 400K+ sites, could allow attackers to steal sensitive data.
An unauthenticated SQL injection flaw, tracked as CVE-2026-2413 (CVSS score 7.5), in Ally plugin could allow attackers to steal sensitive data. The offensive security engineer Drew Webber at Acquia discovered the vulnerability on February 4, 2026.
Ally (formerly One Click Accessibility) is a free WordPress plugin that helps creators build accessible websites. It offers an accessibility scanner with AI suggestions, a usability widget for visitors, and an automated accessibility statement generator. The plugin is used on over 400,000 WordPress sites.
The flaw could allow attackers to extract sensitive database data, including password hashes. The issue was responsibly reported by Drew Webber through the Wordfence Bug Bounty Program, earning an $800 bounty. Wordfence notified Elementor on February 13, the vendor acknowledged the report on February 15, and released a patch on February 23, 2026.
Users are urged to update to Ally version 4.1.0 to mitigate the risk.
EXPLORE MORE
Parents await Supreme Court ruling on gender transition law after daughter ran away
The U.S. Supreme Court (SCOTUS) has agreed to hear a heart-wrenching case…
Pentagon eyeing megaraid to steal Iran’s nuclear stockpile
The Pentagon is contemplating what could become “the most sophisticated operation in military…
YMCA drops ‘gender identity’ pledge after parents group warns about pro-transgender policies
The YMCA has dropped its “gender identity” pledge after a national parents…
![Wanted: Suspect for Commercial Burglary in the 1st District [VIDEO]](https://thephillypi.com/wp-content/uploads/2026/07/Wanted-Suspect-for-Commercial-Burglary-in-the-1st-District-VIDEO-768x512.jpg "Wanted: Suspect for Commercial Burglary in the 1st District [VIDEO]")
Wanted: Suspect for Commercial Burglary in the 1st District [VIDEO]
On April 26, 2026 at approximately 3:30 AM, the suspect was captured…
SolarWinds patches four critical Serv-U flaws enabling root access
SolarWinds addressed four critical Serv-U vulnerabilities that could let attackers gain root…
Chrome security flaw enabled spying via Gemini Live assistant
A Google Chrome vulnerability lets malicious extensions hijack Gemini Live to spy…
The vulnerability stems from insecure handling of the subscribers query in Ally. The plugin builds a SQL JOIN query using a page URL parameter without using WordPress’ wpdb->prepare() function, which normally escapes and parameterizes queries.
Although esc_url_raw() is used, it does not prevent SQL injection. This flaw allows attackers to inject malicious SQL. By exploiting it with time-based blind SQL injection, using CASE statements and SLEEP() delays, an attacker could gradually extract sensitive information from the database.
“The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3.” reads the advisory published by WordFence. “This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations()` method, where it is directly concatenated into an SQL JOIN clause without proper sanitization for SQL context. While `esc_url_raw()` is applied for URL safety, it does not prevent SQL metacharacters (single quotes, parentheses) from being injected. “
The development team addressed the issue by using the wpdb prepare() function in the JOIN statement.
“The vulnerability has been addressed in version 4.1.0 of the plugin.” concludes the advisory. “We encourage WordPress users to verify that their sites are updated to the latest patched version of Ally as soon as possible considering the critical nature of this vulnerability.”
