Vulnerability threat dossier
The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations()` method, where it is directly concatenated into an SQL JOIN clause without proper sanitization for SQL context. While `esc_url_raw()` is applied for URL safety, it does not prevent SQL metacharacters (single quotes, parentheses) from being injected. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection techniques. The Remediation module must be active, which requires the plugin to be connected to an Elementor account.
VTP analyst assessment
Ally – Web Accessibility & Usability through 4.0.3 allows SQL injection through a URL path. The flaw concatenates attacker-controlled input into a SQL JOIN clause. ProjectDiscovery added public Nuclei template coverage, but no supplied source reports active exploitation.
2 record references and 1 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.
The supplied record does not establish reliable exploitation or successful compromise.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
If you use the Ally plugin, identify versions through 4.0.3 and apply vendor remediation.
VTP deterministic assessment
A proof of concept is reported; functional reliability is not established.
EPSS is 0.02; this is predictive context, not exploitation evidence.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Material change ledger
Claim provenance
0 primary sources · 0 dependent secondary reports · 1 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
ProjectDiscovery nuclei-templates published new or materially changed exploit-oriented tooling for this CVE. This is availability evidence, not evidence of exploitation in the wild.
ProjectDiscovery Nuclei Templates Releases published evidence linked to CVE-2026-2413.
Original publications
ProjectDiscovery nuclei-templates recorded exploit-tooling coverage changes for 2 CVEs in this pinned revision. 2 have an active availability assertion for this revision. Tooling evidence does not establish exploitation in the wild or successful execution.
New Templates Added: 94 | CVEs Added: 47 | First-time contributions: 12 🔥 Release Highlights 🔥 [ CVE-2026-27971 ] Qwik - Unauthenticated RCE via server$ Deserialization ( @omarkurt ) [critical] 🔥 [ CVE-2026-27944 ] Nginx UI < 2.3.3 - Information Disclosure ( @omarkurt ) [critical] 🔥 [ CVE-2026-1603 ] Ivanti Endpoint Manager - Authentication Bypass ( @dhiyaneshdk , @watchtowrlabs ) [high] (KEV) (vKEV) 🔥 [ CVE-2026-1492 ] WP User Registration & Membership <= 5.1.2 - Unauth Privilege Escalation ( @omarkurt ) [critical] (vKEV) 🔥 [ CVE-2026-1357 ] WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload ( @omarkurt ) [critical] (vKEV) 🔥 [ CVE-2026-0770 ] Langflow < 1.3.0 - Remote Code Execution via validate_code() exec() ( @affix ) [critical] (vKEV) 🔥 [ CVE-2025-71243 ] SPIP Saisies - Remote Code Execution ( @omarkurt ) [critical] 🔥 [CVE-2025-64328] FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection (@_th3y) [critical] (KEV) (vKEV) 🔥 [ CVE-2025-40554 ] SolarWinds Web Help Desk - Authentication Bypass ( @Bushi-gg ) [critical] 🔥 [ CVE-2025-40552 ] SolarWinds Web Help Desk - Authentication Bypass ( @watchtowr , @dhiyaneshdk ) [critical] 🔥 [ CVE-2025-40536 ] SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass ( @inokii ) [high] (KEV) (vKEV) 🔥 [ CVE-2024-37261 ] WP-Lister Lite for Amazon <= 2.6.16 - Cross-Site Scripting (@Kazgangap) [medium] (vKEV) 🔥 [ CVE-2024-9643 ] Four-Faith F3x36 - Authentication Bypass ( @trader642 ) [critical] (vKEV) 🔥 [ CVE-2023-3452 ] WordPress Canto Plugin <= 3.0.4 - File Inclusion ( @omarkurt ) [critical] 🔥 [ CVE-2021-28481 ] Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound) ( @daffainfo ) [critical] (vKEV) 🔥 [ CVE-2021-28480 ] Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound) ( @daffainfo ) [critical] 🔥 What's Changed Bug Fixes Corrected wrong PoC in CVE-2025-54253 (template was using the PoC for CVE-2025-49533 ) (Issue #14783 ) Fixed @Host variable generation in multiple UniFi templates causing malformed requests (PR #15575 ) Fixed invalid reference URL in CVE-2021-37704 (PR #15524 ) Fixed broken reference URL in cpanel backup config template (PR #15379 ) Fixed malformed matcher formatting in CVE-2025-40554 (PR #15375 ) False Negatives Fixed exposed-svn.yaml failing to detect valid SVN repositories despite receiving 200 OK responses (Issue #15060 ) False Positives Reduced false positives in CVE-2025-14847 triggering on non-MongoDB services due to blind payload injection and flawed matcher logic (Issues #15519 , #15560 , PRs #15520 , #15579 ) Fixed version comparison logic in CVE-2026-25892 causing false positives on non-vulnerable versions (Issue #15356 , PR #15462 ) Fixed CVE-2024-2473 executing without confirming the target plugin is present (Issue #15525 ) Fixed CVE-2021-24527 generating false positive results (Issue #13607 ) Reduced false positives in the following templates: CVE-2021-37833 HotelDruid fingerprint matcher (PR #15597 ) CVE-2023-45648 Apache Tomcat version matcher (PR #15591 ) laravel-env exposure via negative HTML body matcher (PR #15598 ) checkmk-info-disclosure (PR #15564 ) Charset detection template via missing Content-Type check (PR #15533 ) CVE-2024-27198 JetBrains TeamCity (PR #15425 ) CVE-2024-4295 (PR #11442 ) Enhancements Enriched classification metadata (CVE IDs, CVSS scores, CPEs, NVD references) across multiple templates (PRs #15578 , #15589 , #15369 , #15370 , #15371 ) Updated ClawdBot Gateway exposure template with improved detection logic (PR #15548 ) Renamed Forcepoint Login panel template to follow naming conventions (PR #15582 ) Templates Added [ CVE-2026-27971 ] Qwik - Unauthenticated RCE via server$ Deserialization ( @omarkurt ) [critical] 🔥 [ CVE-2026-27944 ] Nginx UI < 2.3.3 - Information Disclosure ( @omarkurt ) [critical] 🔥 [ CVE-2026-27645 ] Changedetection.io RSS Single Watch - Cross-Site Scripting (@0x_Akoko) [medium] [CVE-2026-25512] Group-Offic
Technical vulnerability data
Raw observations
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.