CVE-2025-13309

CVE-2025-13309 documents confirm a WordPress plugin, Accessiy by CodeConfig Accessibility, is vulnerable to an authorization bypass. Affected versions up to and including 1.0.0 allow authenticated users with subscriber-level access and above to modify the plugin’s global accessibility settings du...

CVE-2025-13309 Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters <= 1.0.2 - Authenticated (Subscriber+) Missing Authorization to Modify Accessibility Settings

The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.2. This is due to the plugin not properly verifying that a user is authorized to perform an action...

CVE-2025-13309 Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters <= 1.0.2 - Authenticated (Subscriber+) Missing Authorization to Modify Accessibility Settings

The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.2. This is due to the plugin not properly verifying that a user is authorized to perform an action...

WordPress Accessiy By CodeConfig Accessibility plugin <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Page Creation vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin CodeConfig Accessibility versions = 1.0.0...

PT-2025-49340

The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action...

CVE-2025-13358: Missing Authorization

The Accessiy By CodeConfig Accessibility plugin for WordPress is vulnerable to unauthorized page creation due to missing authorization checks in versions up to, and including, 1.0.0. This is due to the plugin not performing capability checks in the Settings::createPage function. This makes it...

CVE-2025-13309: Missing Authorization

The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.2. This is due to the plugin not properly verifying that a user is authorized to perform an action...

WordPress plugin Accessiy by CodeConfig: accessibility security vulnerabilities

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host a personal blog site on a PHP and MySQL based server.WordPress plugin i...

WordPress plugin Accessiy by CodeConfig: accessibility security vulnerabilities

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host a personal blog site on a PHP and MySQL based server.WordPress plugin i...

New Variant of ClayRat Android Spyware Seize Full Device Control

The dangerous ClayRat Android spyware has evolved, gaining the ability to steal PINs, record screens, and disable security by abusing Accessibility Services. Users must beware of fake apps spreading through phishing sites and Dropbox...

Linux kernel Data Compromise

The vulnerability of the kernel component of the Linux operating system is related to the copying of buffers without checking the input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

HarmonyOS Data Compromise

The vulnerability of the HarmonyOS operating system is related to the operation of data beyond the buffer in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Linux kernel vsock Data Compromise

The vulnerability of the vsock component in the Linux operating system’s kernel is related to the use of memory after it has been freed. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

f2fs Kernel Data Compromise

The vulnerability of the f2fs component of the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Data Compromise

The vulnerability of the PMU firmware microcode generated using Xilinx SDK/Vitis/PetaLinux software tools in Zynq UltraScale+ devices is related to errors in processing input data. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of...

Google Chrome V8 Engine Use-After-Free

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type mixing errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a specially created HTML page...

CTF Archive: Capture, Curate, Learn Forever

Capture the Flag CTF competitions represent a powerful experiential learning approach within cybersecurity education, blending diverse concepts into interactive challenges. However, the short duration typically 24-48 hours and ephemeral infrastructure of these events often impede sustained...

Malicious Package

Overview @vleo-dev/a11y-js-service is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

ConnectWise Automate Plaintext Transmission

The vulnerability of the ConnectWise Automate platform for remote monitoring and control is related to the transmission of critical information in plaintext. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protecte...

Linux NVME Kernel Driver Heap Buffer Overflow DoS

The vulnerability of the nvmetreqComplete function in the drivers/nvme/target/core.c file of the Linux kernel’s NVME support module is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...