CVE-2026-6443

Received Received - Intake

Backdoor Injection in Accordion Slider Plugin Enables Persistent Spam

Publication date: 2026-04-17

Last updated on: 2026-04-21

Assigner: Wordfence

Description

All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-17

Last Modified

2026-04-21

Generated

2026-07-07

AI Q&A

2026-04-17

EPSS Evaluated

2026-07-05

NVD

CVE-2026-6443

EUVD

EUVD-2026-23384

Affected Vendors & Products

Vendor	Product	Version / Range
accordion	accordion_slider	1.4.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-506	The product contains code that appears to be malicious in nature.

Attack-Flow Graph

Executive Summary

The Accordion and Accordion Slider plugin for WordPress version 1.4.6 contains an injected backdoor. This happened because the plugin was sold to a malicious threat actor who embedded a backdoor into all copies of the plugin they acquired.

This backdoor allows the attacker to maintain persistent unauthorized access to websites using the plugin.

Additionally, the attacker can inject spam into the affected sites.

Impact Analysis

This vulnerability can have severe impacts including unauthorized persistent access to your website by a malicious actor.

The attacker can inject spam content into your site, which can damage your site's reputation and SEO.

Given the high CVSS score of 9.8, the vulnerability poses a critical risk affecting confidentiality, integrity, and availability of your site.

Hi! I’m here to help you understand CVE-2026-6443. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70