The flaw is a missing authorization check in the PickPlugins Accordion plugin, allowing an attacker to exploit incorrectly configured access control security levels. This broken access control can enable unauthorized users to modify plugin settings, content, or potentially other site data managed through the plugin. The weakness is classified as CWE‑862, indicating that proper user authentication and authorization checks are not enforced.

The vulnerability affects the PickPlugins Accordion plugin for WordPress, impacting all installations of versions from the earliest available release up through version 2.3.15. No additional version specifics are provided in the source data, so any deployment of the plugin falling within this range is susceptible.

The CVSS score of 6.5 indicates medium severity, and the very low EPSS (< 1%) suggests that exploitation is unlikely at present. The plugin’s functionality is web‑based, so the attack vector is inferred to be remote via the WordPress front‑end or administrative interface. An attacker would need to access the plugin’s configuration pages without proper permission checks; the effect is limited to the scope of the plugin, but could compromise site integrity if the plugin is used to render content.