CVE-2025-13358: 
WordPress vulnerability analysis and mitigation

CVE-2025-13358 is a missing authorization vulnerability in the Accessiy By CodeConfig Accessibility plugin for WordPress, affecting versions up to and including 1.0.0. The flaw allows authenticated attackers with Subscriber-level access or higher to create arbitrary published pages on the affected site via the ccpcaCreatePage AJAX action. It was published on December 6, 2025, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-862 (Missing Authorization). The Settings::createPage() function in the plugin's AJAX handler does not perform any WordPress capability checks before executing page creation logic, meaning any authenticated user — regardless of role — can invoke the ccpcaCreatePage AJAX action over the network. The vulnerable code is visible in the plugin's source at includes/Ajax/Settings.php#L96 and the AJAX registration at includes/Ajax.php#L24. No special conditions or elevated privileges beyond a basic WordPress account are required for exploitation (Wordfence, WordPress Trac).

Successful exploitation allows low-privileged authenticated attackers to inject arbitrary published content into the WordPress site, directly compromising site integrity. Attackers could publish spam, phishing pages, or malicious content under the site's trusted domain, potentially deceiving visitors or facilitating further attacks such as credential harvesting. Confidentiality and availability are not directly impacted; the primary risk is unauthorized content creation and reputational damage (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a valid WordPress subscriber account, limiting the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Obtain a WordPress account: Register or obtain a Subscriber-level (or higher) account on the target WordPress site running the Accessiy By CodeConfig Accessibility plugin version ≤ 1.0.0.
2. Authenticate: Log in to the WordPress site to obtain a valid session cookie and nonce (if required).
3. Craft the AJAX request: Send an authenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to ccpcaCreatePage and any desired page content in the request body.
4. Trigger unauthorized page creation: Because the Settings::createPage() function performs no capability checks, the server processes the request and publishes the attacker-controlled page on the site.
5. Verify: Confirm the newly created page is publicly accessible on the site, potentially containing malicious or spam content (Wordfence, WordPress Trac).

• Network: Authenticated POST requests to /wp-admin/admin-ajax.php with action=ccpcaCreatePage from low-privileged user accounts.
• Logs: WordPress access logs showing repeated AJAX calls to admin-ajax.php with the ccpcaCreatePage action from Subscriber-level users; unexpected page creation events in WordPress audit logs.
• File System / Database: Unexpected published pages in the WordPress wp_posts table with post_status = 'publish' created by low-privileged user accounts, particularly with unusual or spammy content.

Site administrators should update the Accessiy By CodeConfig Accessibility plugin to a version above 1.0.0, which includes the necessary authorization checks in the Settings::createPage() function. If an immediate update is not possible, consider deactivating or removing the plugin until a patched version is applied. Additionally, review recently published pages for unauthorized content and audit user accounts with Subscriber-level access (Wordfence, ENISA EUVD).