PT-2026-8064 · WordPress · Accordion Slider+1

Kazuma Matsumoto · Published 2026-02-14 · Updated 2026-02-14 · CVE-2026-0727

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Accordion and Accordion Slider plugin for WordPress versions prior to 1.4.6

Description The Accordion and Accordion Slider plugin for WordPress is susceptible to authorization bypass in versions up to and including 1.4.5. The plugin does not adequately verify user authorization when performing actions within the wp aas save attachment data and wp aas get attachment edit form functions. This allows authenticated attackers with contributor-level access or higher to read and modify attachment metadata, including file paths, titles, captions, alt text, and custom links, for any attachment on the site.

Recommendations Update the Accordion and Accordion Slider plugin to version 1.4.6 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-0727

Affected Products

Accordion

Accordion Slider

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-0727 · Security Note
• https://twitter.com/VulmonFeeds/status/2022717056299237770 · Twitter Post
• https://plugins.trac.wordpress.org/browser/accordion-and-accordion-slider/tags/1.4.6/includes/admin/class-wp-aas-admin.php#L294 · Note
• https://twitter.com/CVEnew/status/2022567910208868355 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1c5108f3-d80c-4646-8d40-3bdd1361c6ab?source=cve · Note