What is the CVSS score of CVE-2025-58024?

CVE-2025-58024 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Accordion FAQ are affected by CVE-2025-58024?

UnboundStudio's Accordion FAQ WordPress plugin (through version 2.2.1) enables authenticated WordPress users to access sensitive server configuration files containing database credentials and API…

How to fix or mitigate CVE-2025-58024?

Within 24 hours: Deactivate and remove the Accordion FAQ plugin (all versions up to 2.2.1) from all WordPress installations; verify no unauthorized administrator accounts were added. Within 7 days: Rotate all database credentials; review WordPress access logs and audit trails for evidence of exploitation or suspicious file access patterns. Within 30 days: Deploy an alternative FAQ plugin; establish a quarterly plugin security assessment process and create a vendor notification playbook for future vulnerabilities.

Accordion FAQ CVE-2025-58024

EUVD-2025-210037 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-02 Patchstack

GHSA-vhq5-8hgm-w39r

LFI Information Disclosure PHP

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 11:52 vuln.today

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnboundStudio Accordion FAQ allows PHP Local File Inclusion.

This issue affects Accordion FAQ: from n/a through 2.2.1.

AnalysisAI

Local file inclusion in the UnboundStudio Accordion FAQ WordPress plugin (versions up to and including 2.2.1) allows authenticated remote attackers to include and execute arbitrary PHP files from the server filesystem via improperly controlled include/require statements. The flaw, reported by Patchstack and tagged as LFI/Information Disclosure, can lead to full compromise of the WordPress instance through disclosure of sensitive configuration data (e.g., wp-config.php) and potential code execution if attacker-controlled files are reachable. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability is a CWE-98 Improper Control of Filename for Include/Require Statement (PHP Remote File Inclusion), manifesting here as Local File Inclusion in a WordPress plugin. The affected component is the pressapps-accordion-faq plugin distributed by UnboundStudio (CPE cpe:2.3:a:unboundstudio:accordion_faq), which dynamically constructs a path passed to a PHP include/require call without adequately sanitizing user-supplied input. Because WordPress plugins execute within the main PHP runtime, any file successfully included is parsed as PHP, meaning the bug can read arbitrary local files and, when chained with an attacker-controlled file upload or log poisoning, can escalate to remote code execution within the web server context.

RemediationAI

No vendor-released patch identified at time of analysis: the Patchstack advisory documents the issue through 2.2.1 without naming a fixed release, so administrators should monitor the WordPress plugin repository and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/pressapps-accordion-faq/vulnerability/wordpress-accordion-faq-plugin-2-2-1-local-file-inclusion-vulnerability) for a patched version above 2.2.1 and upgrade immediately when available. Until a fix ships, compensating controls include deactivating and removing the Accordion FAQ plugin (trade-off: loss of FAQ display functionality), enrolling the site behind Patchstack's virtual patching/WAF or an equivalent WordPress WAF with rules blocking traversal sequences and PHP wrappers (php://, file://, data://) on plugin endpoints, hardening php.ini with allow_url_include=Off and open_basedir scoped to the WordPress root to limit file disclosure, and restricting registration so that low-privileged accounts (PR:L) cannot be easily obtained by anonymous attackers.