CVE-2026-0635

Responsive Accordion Slider <= 1.2.2 - Missing Authorization to Authenticated (Contributor+) Slider Update via 'resp_accordion_silder_save_images'

View on CVE.org
Published Jan 14, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
The Responsive Accordion Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resp_accordion_silder_save_images' function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify any slider's image metadata including titles, descriptions, alt text, and links.

Analysis

AI-generated

Technical impact

The Vulnerable Responsive Accordion Slider plugin incorrectly allows the resp_accordion_silder_save_images function to be called without checking the user's capability. An attacker who is authenticated with Contributor level or higher can exploit this flaw to change any slider’s image titles, descriptions, alt text, and links, effectively defacing the site’s content. This behavior conforms to CWE‑862 (Missing Authorization).

Affected Systems

All installations of the Responsive Accordion Slider plugin by techknowprime, up through version 1.2.2, are impacted. No newer versions are mentioned as affected.

Risk and Exploitability

The CVSS base score of 4.3 indicates moderate impact, and the EPSS < 1 % suggests a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that the user be logged in with Contributor or higher privileges and use the admin interface to submit the resp_accordion_silder_save_images endpoint.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Responsive Accordion Slider plugin to a version newer than 1.2.2 that includes a capability check for the resp_accordion_silder_save_images function.
  • If an update is not immediately available, remove or downgrade the Contributor role’s ability to edit or update sliders, or assign a role that lacks the capability to call the affected function.
  • Configure a security logging solution to record changes to slider metadata and alert site administrators to any unauthorized modifications.

Generated by OpenCVE AI on April 15, 2026 at 19:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description The Responsive Accordion Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resp_accordion_silder_save_images' function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify any slider's image metadata including titles, descriptions, alt text, and links.
Title Responsive Accordion Slider <= 1.2.2 - Missing Authorization to Authenticated (Contributor+) Slider Update via 'resp_accordion_silder_save_images'
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Apr 8, 2026, 4:53 PM
Reserved
Jan 6, 2026, 1:49 AM

View source JSON

Updated
Jan 15, 2026, 6:31 PM

JSON

Status
Deferred
Published
Jan 14, 2026, 6:15 AM
Modified
Jun 17, 2026, 10:11 AM

View source JSON

No data.

Updated
Apr 15, 2026, 7:15 PM

JSON