# The State of Motion Accessibility on WordPress

*Study · 21 Jul 2026 · MotionSpec*

We scanned 50 real, independently-run WordPress sites for two specific motion-accessibility problems. Unguarded and unstoppable motion turned out to be the norm — not the exception.

## Headline (N=50 verified WordPress sites)

- **92%** ship motion that ignores the visitor's "reduce motion" setting (WCAG 2.3.3).
- **64%** run animation you can't pause (WCAG 2.2.2, Level A).
- **15/100** median motion-accessibility score.
- **0** sites verified clean out of 50.

Floor numbers: a static CSS scan under-reports JavaScript, GSAP and canvas motion by design, so the real failure rate is at least this high — not lower.

## Why now — honestly

This started with a security scare. wp2shell (CVE-2026-63030) is an actively-exploited, unauthenticated RCE in WordPress core, disclosed by Adam Kues of Searchlight Cyber. Security ≠ accessibility: for the RCE, update WordPress core to 6.9.5 / 7.0.2 or later — advisory at https://wp2shell.com/. We don't fix that and won't pretend to. But the wp2shell moment has admins auditing this week, so it's a fair time to point at the other liability on the same sites: motion accessibility.

## What we found

92% shipped ≥1 violation; 64% ran an infinite animation with no pause control; median 15/100. Four sites scored 100 — but all were "no CSS motion found," so zero were verified clean-with-visible-motion. Violations came from ubiquitous plugins/themes, so one site-wide prefers-reduced-motion guard fixes the whole class.

## The fix: MotionSpec Motion Guard (free WordPress plugin)

Scans a site and shows each finding with its fix, and applies a site-wide reduced-motion guard (WCAG 2.3.3) plus an optional pause control (WCAG 2.2.2). Not an overlay; no WCAG/legal-compliance promise.

## Method & limits

Real business and organization sites across many verticals and countries, each confirmed to run WordPress from the audit itself, scanned once with MotionSpec's static motion audit. N=50, a convenience sample, not randomized, US-skewed (37 of 50, with 10 German); static single-page scan (under-reports JS motion). 2.3.3 = Level AAA / best practice; 2.2.2 = Level A. A score is a signal, not a legal verdict.

**Disclosure:** MotionSpec makes the checker and plugin referenced here. wp2shell and its remediation are Searchlight Cyber's work.