WordPress Plugin Vulnerabilities

Accordion < 2.3.16 - Missing Authorization

Description

The Accordion – AI FAQ, Accordion, Tabs, Image Accordion, Product FAQ, FAQ Builder, FAQ Grid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the get_post_data() function in all versions up to, and including, 2.3.15. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve post data.

Affects Plugins

Fixed in 2.3.16

References

Classification

Type
NO AUTHORISATION
CWE

Miscellaneous

Original Researcher
Abu Hurayra
Verified
No

Timeline

Publicly Published
2025-09-22 (about 8 months ago)
Added
2025-09-26 (about 7 months ago)
Last Updated
2025-09-26 (about 7 months ago)

Other