Accordion And Accordion Slider CVE-2026-6443

No special conditions - remote unauthenticated exploitation against any WordPress site with Accordion and Accordion Slider version 1.4.6 installed and active. The backdoor code executes automatically as part of the plugin's normal WordPress initialization process (typically via plugin hooks that fire on every page load or admin access). Exploitation does not require specific WordPress configurations, theme choices, or additional plugin dependencies. Sites are vulnerable immediately upon installing or auto-updating to version 1.4.6. The attack surface is not limited by user interaction, authentication requirements, or network positioning - any internet-accessible WordPress site with the plugin active is exploitable. The backdoor's persistence mechanism survives WordPress core updates and theme changes, remaining active until the plugin is manually removed.

CRITICAL priority requiring immediate action. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicates trivial exploitation - remote, unauthenticated, low-complexity attack against any site running the compromised version. This is not a theoretical vulnerability but confirmed malicious code intentionally planted by the plugin owner, representing active supply chain compromise. The attack affects the integrity of the WordPress.org plugin repository itself, not just a coding flaw. While EPSS and KEV data are not provided, the Wordfence Threat Intelligence disclosure and Anchor.host reporting confirm the threat as real and deliberately deployed. Risk extends beyond individual sites to the trust model of the WordPress plugin ecosystem. The threat actor controls the update mechanism, meaning they can push additional malicious updates at will. Sites with version 1.4.6 installed should assume compromise. The broad scope (30+ plugins acquired by the same actor per Anchor.host reference) suggests systematic, profit-motivated attack rather than targeted espionage, increasing probability of widespread automated exploitation for spam injection and SEO manipulation.

Attacker leverages pre-installed backdoor in version 1.4.6 to access WordPress site without authentication. The malicious code executes automatically when WordPress loads the plugin, providing persistent remote access. Attacker uses backdoor to inject spam content into posts, create hidden admin accounts, install additional webshells, or exfiltrate site data including customer information from WooCommerce installations. Since the backdoor exists in legitimately installed plugin code, traditional web application firewalls and security plugins may not detect the malicious activity as it appears to originate from trusted plugin code.