A missing authorization flaw in the QuanticaLabs CSS3 Accordions for WordPress plugin allows users to gain privileges beyond those intended for their accounts. The vulnerability stems from an incorrect configuration of access control levels, resulting in a broken access control weakness (CWE‑862). An attacker who succeeds can read, modify, or delete content managed by the plugin, potentially exposing sensitive information or disrupting site functionality.

QuanticaLabs’ CSS3 Accordions for WordPress plugin is affected. All releases from the earliest available version up through version 3.0 are vulnerable. No specific version ranges were detailed in the CNA data, so all installations using a vulnerable release date to 3.0 should be considered at risk.

The CVSS base score of 5.4 indicates moderate risk, while the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers would most likely exploit this flaw through the web interface of a WordPress site hosting the plugin; the exact nature of the privilege escalation depends on the site’s role configuration but could be achieved by any authenticated user lacking appropriate capabilities.