CVE-2024-5987

4.3 mediumEPSS 0.3%

Medium (4.3) in volkov wp accessibility helper. EPSS 0.3% chance of exploitation in the next 30 days.

The WP Accessibility Helper (WAH) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_contrast_variations' and 'save_empty_contrast_variations' functions in all versions up to, and including, 0.6.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit or delete contrast settings. Please note these issues were patched in 0.6.2.8, though it broke functionality and the vendor has not responded to our follow-ups.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2024-08-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

volkov:wp_accessibility_helper

References

Check your stack JSON