CVE-2026-2413
Published: 11 March 2026
Summary
CVE-2026-2413 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to and including 4.0.3. The flaw exists in the get_global_remediations() method, where a user-supplied URL parameter is concatenated directly into an SQL JOIN clause without adequate sanitization for SQL metacharacters, even though esc_url_raw() is applied. This affects the Remediation module when the plugin is connected to an Elementor account and is tracked under CWE-89 with a CVSS 3.1 score of 7.5.
Unauthenticated attackers can exploit the issue over the network to perform time-based blind SQL injection, enabling extraction of sensitive database contents. Successful exploitation requires the Remediation module to be active but needs no user interaction or authentication.
Public references point to a WordPress plugin changeset that updates the remediation-entry.php file, indicating an available patch for the affected code paths. The Wordfence advisory further details the vulnerability and its scope.
EPSS for this CVE rose from lower values to a peak of 0.3778 with a current score of 0.2728, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11081
Vulnerability details
The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the…
more
`get_global_remediations()` method, where it is directly concatenated into an SQL JOIN clause without proper sanitization for SQL context. While `esc_url_raw()` is applied for URL safety, it does not prevent SQL metacharacters (single quotes, parentheses) from being injected. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection techniques. The Remediation module must be active, which requires the plugin to be connected to an Elementor account.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WordPress plugin directly enables remote exploitation of a web application for data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of user-supplied URL parameters before concatenation into SQL JOIN clauses, directly preventing the SQL injection in get_global_remediations().
Mandates timely identification, reporting, and patching of flaws like the SQL injection vulnerability in the Ally plugin up to version 4.0.3.
Enables vulnerability scanning to detect the SQL injection flaw in the WordPress plugin and initiate remediation to prevent exploitation.