CVE-2025-13113: 
WordPress vulnerability analysis and mitigation

CVE-2025-13113 is a Sensitive Information Exposure vulnerability in the Web Accessibility by accessiBe plugin for WordPress, classified under CWE-200. All versions up to and including 2.11 are affected. The flaw causes the plugin to log its complete options array — including email addresses, accessiBe user IDs, account IDs, and license information — to the browser console on public-facing pages, accessible to any unauthenticated visitor. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE).

The root cause is the accessibe_render_js_in_footer() function, which unconditionally logs the full plugin options array to the browser console without checking for debug mode or restricting output to privileged users (CWE-200). This behavior is triggered on all public pages when the accessiBe widget is disabled, meaning no authentication or special conditions are required for exposure. The attack vector is purely passive — an attacker simply opens the browser developer console on any affected WordPress page to retrieve the sensitive data (Red Hat CVE, Infinit Sec).

Exploitation allows unauthenticated attackers to harvest sensitive configuration data including email addresses, accessiBe user IDs, account IDs, and license keys from any public page of an affected WordPress site. While there is no direct integrity or availability impact, the exposed data could facilitate account takeover of the accessiBe service, license abuse, or targeted phishing campaigns against site administrators. The scope is limited to confidentiality loss on the affected WordPress instance (Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.031%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The trivial nature of exploitation (browser console inspection) means no specialized tools are required, but the low severity and limited data exposure reduce attacker motivation (Red Hat CVE, Feedly).

1. Reconnaissance: Identify WordPress sites using the Web Accessibility by accessiBe plugin (versions ≤ 2.11) with the widget disabled, using tools like WPScan or by inspecting page source for accessiBe-related script tags.
2. Navigate to a public page: Visit any publicly accessible page of the target WordPress site in a browser.
3. Open browser developer tools: Press F12 or right-click and select "Inspect" to open the browser developer console.
4. Retrieve sensitive data: Observe the console output for the logged plugin options array, which contains email addresses, accessiBe user IDs, account IDs, and license information — no authentication or interaction required (Red Hat CVE, Infinit Sec).

• Logs: Web server access logs showing repeated requests to public pages from unfamiliar IPs, particularly with no referrer or automated user-agent strings, may indicate reconnaissance activity.
• Network: No specific network-level IOC exists, as exploitation requires only standard HTTP page requests; however, unusual spikes in page views from single IPs could be indicative.
• Application: No file system or registry changes are associated with this vulnerability, as exploitation is entirely passive (read-only browser console inspection).

Users should update the Web Accessibility by accessiBe plugin to a version above 2.11 that removes or restricts the console logging behavior in accessibe_render_js_in_footer(). As a temporary workaround, site administrators can disable the plugin entirely until a patched version is available. Restricting public access to pages using the plugin or monitoring for unusual traffic patterns may reduce exposure risk in the interim (Red Hat CVE, Infinit Sec).