The vulnerability is a missing authorization flaw in the PickPlugins Accordion WordPress plugin. Attackers can exploit incorrect access control settings to gain unauthorized control over the plugin’s administrative functions. This flaw is classified as CWE‑862, which allows unauthorized modification of application state or configuration. Exploitation could let an attacker add, modify, or delete accordion entries and potentially inject arbitrary content into the site, compromising confidentiality and integrity of site data.

PickPlugins Accordion plugin for WordPress, affecting all releases through version 2.3.14. Any website that has the plugin installed at a version equal to or lower than 2.3.14 is affected. The vulnerability is present in all variations of the plugin’s configuration, regardless of user role, as the access control is broken across the board.

The CVSS score of 6.5 indicates a medium severity vulnerability that can impact the confidentiality or integrity of the host site. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the CVE is not listed in the CISA KEV catalogue. The attack vector is likely remote, via web requests to the plugin’s administrative endpoints; however, the description does not explicitly state the vector, so this assessment is inferred from the nature of WordPress plugins and typical access control weaknesses. An attacker would need either legitimate WordPress administrative credentials or an environment with unrestricted access to the plugin’s admin interface to exploit this flaw.