PT-2026-8064 · WordPress · Accordion Slider+1

Kazuma Matsumoto · CVE-2026-0727 · Publicado 2026-02-14 · Atualizado 2026-02-14

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Accordion and Accordion Slider plugin for WordPress versions prior to 1.4.6

Description The Accordion and Accordion Slider plugin for WordPress is susceptible to authorization bypass in versions up to and including 1.4.5. The plugin does not adequately verify user authorization when performing actions within the wp aas save attachment data and wp aas get attachment edit form functions. This allows authenticated attackers with contributor-level access or higher to read and modify attachment metadata, including file paths, titles, captions, alt text, and custom links, for any attachment on the site.

Recommendations Update the Accordion and Accordion Slider plugin to version 1.4.6 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-0727

Produtos afetados

Accordion

Accordion Slider

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-0727 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2022717056299237770 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/accordion-and-accordion-slider/tags/1.4.6/includes/admin/class-wp-aas-admin.php#L294 · Nota
• https://twitter.com/CVEnew/status/2022567910208868355 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/1c5108f3-d80c-4646-8d40-3bdd1361c6ab?source=cve · Nota