Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance Security & Risk Analysis

The accessibility-checker plugin v1.38.0 exhibits a mixed security posture. On the positive side, it demonstrates strong practices in SQL query handling and output escaping, with 100% of SQL queries using prepared statements and 97% of outputs being properly escaped. The plugin also correctly implements nonce and capability checks for a significant number of its entry points. However, there are clear areas of concern, particularly with its attack surface. Four out of sixteen total entry points, specifically AJAX handlers, lack authentication checks, presenting a direct risk of unauthorized actions. Furthermore, the taint analysis revealed two flows with unsanitized paths, both classified as high severity. While the plugin has no currently unpatched CVEs, its history of three medium-severity vulnerabilities, including missing authorization and authorization bypass, suggests a recurring pattern of authorization-related weaknesses. This indicates a need for ongoing vigilance in securing its entry points and user input validation.