CVE-2026-24565
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-04-01
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bplugins | b_accordion | to 2.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24565 is a Sensitive Data Exposure vulnerability in the WordPress B Accordion Plugin (versions up to and including 2.0.0). It allows a malicious user with Contributor or Developer privileges to access sensitive information that should normally be restricted from regular users. This vulnerability involves the insertion of sensitive information into sent data, enabling unauthorized retrieval of embedded sensitive data. [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to sensitive information by users with Contributor or Developer privileges. Although the severity is considered low (CVSS score 6.5), the exposure of sensitive data could be leveraged by attackers to exploit other system weaknesses, potentially compromising the security and integrity of the affected WordPress site. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by verifying if the WordPress site is running the B Accordion plugin version 2.0.0 or earlier. Since the vulnerability allows users with Contributor or Developer privileges to access sensitive data, checking user roles and permissions for suspicious access attempts may help. However, no specific detection commands or network signatures are provided. It is recommended to audit plugin versions and user access logs for unusual activity related to the B Accordion plugin. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting user roles to prevent untrusted users from having Contributor or Developer privileges, as these roles can exploit the vulnerability. Additionally, monitoring and limiting access to sensitive data within the plugin is advised. Since no official patch or fix is available as of the publication date, consider disabling or removing the B Accordion plugin until a secure version is released. Utilizing security services like Patchstack's mitigation and intelligence offerings may also help protect affected sites. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.