PT-2026-33416 · WordPress · Accordion/Accordion Slider

Damien · Published 2026-04-17 · Updated 2026-04-29 · CVE-2026-6443

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Accordion and Accordion Slider version 1.4.6

Description The plugin contains an injected backdoor resulting from a supply chain attack where the software was sold to a malicious threat actor. This allows the actor to maintain persistent access to affected sites and inject spam.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-506

Related Identifiers

CVE-2026-6443

Affected Products

Accordion/Accordion Slider

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2026-6443 · Security Note
• https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them · Note
• https://twitter.com/atomicedgeWAF/status/2049089503348863027 · Twitter Post
• https://twitter.com/OrizonCyber/status/2045042125004321175 · Twitter Post
• https://twitter.com/atomicedgeWAF/status/2049119704082432372 · Twitter Post
• https://twitter.com/atomicedgeWAF/status/2049074402902311329 · Twitter Post
• https://twitter.com/CVEnew/status/2045102602698760389 · Twitter Post
• https://twitter.com/atomicedgeWAF/status/2049014004954071109 · Twitter Post
• https://twitter.com/atomicedgeWAF/status/2048998907594559738 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2045110048632823971 · Twitter Post
• https://twitter.com/atomicedgeWAF/status/2049044204915929449 · Twitter Post
• https://twitter.com/atomicedgeWAF/status/2049104605196300528 · Twitter Post
• https://twitter.com/0dayPublishing/status/2045033191719780565 · Twitter Post
• https://twitter.com/atomicedgeWAF/status/2049029105178292593 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045050677311766568 · Twitter Post