EUVD-2026-23384Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
The Accordion and Accordion Slider plugin for WordPress is vulnerable to an injected backdoor in version 1.4.6. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
AnalysisAI
Malicious backdoor in Accordion and Accordion Slider plugin version 1.4.6 allows remote unauthenticated attackers complete site compromise. The plugin was sold to a threat actor who systematically embedded backdoors across their entire portfolio of acquired WordPress plugins. This represents confirmed active supply chain compromise affecting WordPress sites running version 1.4.6, enabling persistent unauthorized access and spam injection without authentication.
Technical ContextAI
This is a supply chain attack (CWE-506: Embedded Malicious Code) targeting the WordPress plugin ecosystem. The threat actor acquired ownership of multiple WordPress plugins, including Accordion and Accordion Slider (identified by CPE cpe:2.3:a:essentialplugin:accordion_and_accordion_slider), and intentionally inserted backdoor code into version 1.4.6. Unlike typical vulnerabilities arising from coding errors, this is deliberate malicious code injection by the plugin maintainer. The backdoor operates at the WordPress PHP execution level, granting the attacker arbitrary code execution capabilities within the WordPress context. This attack pattern mirrors previous WordPress supply chain incidents where plugin ownership transfers resulted in malicious updates being distributed through legitimate WordPress.org channels, affecting users who trust automatic updates.
RemediationAI
Immediately remove Accordion and Accordion Slider version 1.4.6 from all WordPress installations - do not attempt to update through normal channels as the plugin owner is the threat actor. Deactivate and delete the plugin completely via WordPress admin dashboard (Plugins → Deactivate → Delete) or manually remove the plugin directory from wp-content/plugins/. After removal, conduct incident response procedures: review admin user accounts for unauthorized additions, check wp-config.php and .htaccess files for modifications, scan uploads directory for webshells, review recent post/page edits for injected spam content, and examine database wp_options table for suspicious entries. Rotate all WordPress admin passwords and API keys. Consider full site restoration from pre-1.4.6 backup if available. Check WordPress.org plugin page for ownership status before considering any replacement accordion plugin. Install Wordfence or similar security plugin to scan for indicators of compromise. WordPress.org has likely removed the malicious version from their repository, but sites with version 1.4.6 already installed remain compromised until manual removal. No legitimate patched version exists - the plugin itself is the threat vector. Consult Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2597724a-9a39-4e46-b153-f42366f833ba and Anchor.host analysis at https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/ for additional context.
Same weakness CWE-506 – Embedded Malicious Code
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today