The Accordion and Accordion Slider plugin for WordPress is vulnerable because version 1.4.6 contains an injected backdoor that was embedded by a malicious third‑party during the plugin’s sale, reflecting a CWE‑506 vulnerability that introduces code with elevated privileges. The backdoor allows an attacker to maintain persistent access to the affected sites and inject spam or perform other malicious actions. Based on the description, it is inferred that this presents a high‑level risk of unauthorized code execution, data compromise, and broader site compromise.

The vulnerability affects the WordPress plugin Accordion and Accordion Slider, version 1.4.6, sold by essentialplugin. Any WordPress site installing this exact version is directly impacted. No other versions or products are listed as affected.

With a CVSS score of 9.8, this issue is considered critical. The EPSS score is not available, but the backdoor appears to have already been deployed in many sites, suggesting a significant exploitation risk. The vulnerability is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is straightforward: sites that deploy the compromised plugin are immediately compromised, providing an attacker with a full backdoor and spam capabilities.