CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
Explanation of Vulnerability in Simple Terms
Accordion and Accordion Slider versions 1.4.6 and earlier contain a vulnerability that allows unauthenticated attackers to read sensitive data, modify site content, or disrupt service without user interaction. The vulnerability is exploitable over the network with low complexity. No patch version is currently available.
What an attacker can do
Read sensitive data, modify site content, or disrupt service without authentication.
Potential impact on your site
Attackers can compromise your site's data, content, and availability without needing a user account.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
