The Accordion and Accordion Slider plugin for WordPress has an authorization bypass that enables authenticated contributors and higher roles to read and modify any attachment metadata, including file paths, titles, captions, alt text, and custom links. This flaw is classified as CWE‑862, indicating an inadequate check of the user’s authorization before allowing data modification. While the vulnerability does not grant code execution, it permits an attacker to alter media references and potentially deface or mislead users by changing image metadata.

Believed to affect the Essential Plugin Accordion and Accordion Slider for WordPress. Versions up to and including 1.4.5 are vulnerable. The problem exists in plugins built on WordPress and is triggered when the user has contributor-level access or higher.

The CVSS score is 5.4, indicating a moderate severity. The EPSS score is below 1%, meaning current exploitation attempts are infrequent. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user who can authenticate to the WordPress site with a contributor role or higher and then use the admin functions 'wp_aas_save_attachment_data' or 'wp_aas_get_attachment_edit_form' to change attachment metadata. There are no external trigger requirements beyond normal authenticated site access.