What is the CVSS score of CVE-2026-6443?

CVE-2026-6443 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-6443?

Accordion and Accordion Slider plugin version 1.4.6 contains a confirmed malicious backdoor enabling complete WordPress site compromise by unauthenticated remote attackers, resulting from confirmed…

How to fix or mitigate CVE-2026-6443?

Within 24 hours: Identify all WordPress installations running Accordion and Accordion Slider plugin version 1.4.6 using automated scanning tools; immediately deactivate and delete the plugin; review access logs for suspicious activity dating back 30+ days. Within 7 days: Update to a patched alternative plugin or implement equivalent functionality through vetted alternatives (verify no backdoor signatures); conduct forensic analysis for persistence mechanisms and unauthorized admin accounts; reset all WordPress credentials. Within 30 days: Complete malware remediation; deploy Web Application Firewall rules to block known backdoor command patterns; implement plugin security scanning in CI/CD pipeline and establish vendor security baseline for all WordPress plugin sources.

WordPress CVE-2026-6443

EUVD-2026-23384 CRITICAL

Embedded Malicious Code (CWE-506)

2026-04-17 Wordfence

Code Injection WordPress

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 17, 2026 - 07:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 17, 2026 - 07:22 vuln.today

cvss_changed

Analysis Generated

Apr 17, 2026 - 07:12 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 07:00 euvd

EUVD-2026-23384

Analysis Generated

Apr 17, 2026 - 07:00 vuln.today

CVE Published

Apr 17, 2026 - 06:44 nvd

CRITICAL 9.8

DescriptionCVE.org

The Accordion and Accordion Slider plugin for WordPress is vulnerable to an injected backdoor in version 1.4.6. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.

AnalysisAI

Malicious backdoor in Accordion and Accordion Slider plugin version 1.4.6 allows remote unauthenticated attackers complete site compromise. The plugin was sold to a threat actor who systematically embedded backdoors across their entire portfolio of acquired WordPress plugins. This represents confirmed active supply chain compromise affecting WordPress sites running version 1.4.6, enabling persistent unauthorized access and spam injection without authentication.

Technical ContextAI

This is a supply chain attack (CWE-506: Embedded Malicious Code) targeting the WordPress plugin ecosystem. The threat actor acquired ownership of multiple WordPress plugins, including Accordion and Accordion Slider (identified by CPE cpe:2.3:a:essentialplugin:accordion_and_accordion_slider), and intentionally inserted backdoor code into version 1.4.6. Unlike typical vulnerabilities arising from coding errors, this is deliberate malicious code injection by the plugin maintainer. The backdoor operates at the WordPress PHP execution level, granting the attacker arbitrary code execution capabilities within the WordPress context. This attack pattern mirrors previous WordPress supply chain incidents where plugin ownership transfers resulted in malicious updates being distributed through legitimate WordPress.org channels, affecting users who trust automatic updates.

RemediationAI

Immediately remove Accordion and Accordion Slider version 1.4.6 from all WordPress installations - do not attempt to update through normal channels as the plugin owner is the threat actor. Deactivate and delete the plugin completely via WordPress admin dashboard (Plugins → Deactivate → Delete) or manually remove the plugin directory from wp-content/plugins/. After removal, conduct incident response procedures: review admin user accounts for unauthorized additions, check wp-config.php and .htaccess files for modifications, scan uploads directory for webshells, review recent post/page edits for injected spam content, and examine database wp_options table for suspicious entries. Rotate all WordPress admin passwords and API keys. Consider full site restoration from pre-1.4.6 backup if available. Check WordPress.org plugin page for ownership status before considering any replacement accordion plugin. Install Wordfence or similar security plugin to scan for indicators of compromise. WordPress.org has likely removed the malicious version from their repository, but sites with version 1.4.6 already installed remain compromised until manual removal. No legitimate patched version exists - the plugin itself is the threat vector. Consult Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2597724a-9a39-4e46-b153-f42366f833ba and Anchor.host analysis at https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/ for additional context.