PickPlugins Accordion CVE-2026-116392

Exploitation requires an authenticated account with high privileges (administrator-level), as reflected by PR:H in the CVSS vector, on a site running PickPlugins Accordion up to and including version 2.3.25. Realistic impact also depends on the presence of a usable PHP POP gadget chain (in the plugin, core, or other installed code) to turn object injection into concrete code or data effects. The exact feature, parameter, or configuration that reaches the deserialization sink is not described in the available sources. The high-privilege requirement is the principal limiting factor, substantially narrowing the realistic attacker population.

This is a CWE-502 PHP Object Injection flaw in the PickPlugins Accordion WordPress plugin, reported by Patchstack and assigned a vuln.today priority of 'this_week' rather than act_now or emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) indicates a network-reachable, low-complexity attack with full confidentiality/integrity/availability impact but requiring high privileges (PR:H), meaning an attacker must already hold an elevated, authenticated WordPress account before the flaw is reachable. That PR:H requirement is the dominant mitigating factor and is consistent with Patchstack's typical modelling of plugin object-injection bugs, which usually sit behind an authenticated admin-level sink. No EPSS score and no CISA KEV listing are present in the input, and no verified working exploit is shown, so there is no signal of active or widespread exploitation; the 7.2 score reflects potential impact, not observed in-the-wild use. Net: a genuine but not emergency-grade issue - real impact if an attacker obtains high-privilege access, but the privilege barrier and absence of exploitation signals place it at routine-patch urgency consistent with the 'this_week' decision label.

An attacker who already holds a high-privileged (administrator-level) authenticated account on a WordPress site running Accordion ≤ 2.3.25 submits crafted serialized input to a plugin code path that deserializes it, triggering PHP object injection. If a suitable POP gadget chain is available from the plugin or other installed code, this can escalate to confidentiality, integrity and availability impact on the site. No verified public exploit code is present in the supplied data; the only reference is the Patchstack advisory.