PT-2020-13634 · WordPress · Accordion

Published 2020-05-28 · Updated 2020-05-28 · CVE-2020-13644

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Accordion plugin versions prior to 2.2.9

Description An issue in the Accordion plugin for WordPress allows any authenticated user with Subscriber or higher permissions to import a new accordion and inject malicious JavaScript. This is due to the unprotected AJAX wp ajax accordions ajax import json action.

Recommendations For versions prior to 2.2.9, update to version 2.2.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the wp ajax accordions ajax import json AJAX action to prevent malicious JavaScript injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-13644

Affected Products

Accordion

References · 5

• 🔥 https://wordfence.com/blog/2020/04/vulnerability-patched-in-accordion-plugin · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13644 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13644 · Vendor Advisory
• https://wordpress.org/plugins/accordions/#developers · Note
• https://t.me/cvenotify/4060 · Telegram Post