Accessibility Suite by Ability, Inc Security & Risk Analysis

The 'online-accessibility' plugin version 4.20 exhibits a mixed security posture. On the positive side, the plugin demonstrates strong adherence to secure coding practices with a very high percentage of prepared SQL statements and properly escaped output. The absence of dangerous functions and critical or high severity taint flows is also a good indicator. However, significant concerns arise from the substantial attack surface, particularly the 13 AJAX handlers and 5 REST API routes that lack authentication or permission checks. This creates numerous entry points that could be exploited by unauthenticated users.

The vulnerability history of this plugin is a major red flag. With a total of 7 known CVEs, including 4 high and 3 medium severity vulnerabilities, the plugin has a history of significant security flaws. While there are currently no unpatched vulnerabilities, the recurring nature of issues like Missing Authorization and SQL Injection suggests potential systemic weaknesses in the development process. The recent vulnerability dated 2025-06-05 indicates that new vulnerabilities can still be discovered or introduced.

In conclusion, while the code quality regarding SQL prepared statements and output escaping is commendable, the lack of proper authorization checks on a significant portion of its entry points and its problematic vulnerability history present considerable risks. The plugin needs to prioritize addressing these authorization gaps and demonstrate a more robust security development lifecycle to mitigate the risk of future high-severity vulnerabilities.