An improper control of the filename used by the Accordion FAQ plugin’s PHP include/require statement allows an attacker to include arbitrary files from the server. By manipulating input to the plugin, an adversary can read sensitive files such as configuration files, credentials, or logs, and may be able to execute malicious code if the attacker can point the include at a PHP file. This results in a serious breach of confidentiality and integrity and could lead to full system compromise.

The vulnerability affects the UnboundStudio Accordion FAQ plugin for WordPress, versions from an unspecified initial release through and including 2.2.1.

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, so the probability of exploitation is unknown; the vulnerability is not listed in the CISA KEV catalog. Attackers can likely exploit this through the plugin’s front‑end or administrative interface, though the specific authentication requirements are not detailed in the description, implying that even unauthenticated users may be able to supply input to trigger the inclusion.