CVE-2026-6443
Backdoor Injection in Accordion Slider Plugin Enables Persistent Spam
Publication date: 2026-04-17
Last updated on: 2026-04-21
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| accordion | accordion_slider | 1.4.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-506 | The product contains code that appears to be malicious in nature. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Accordion and Accordion Slider plugin for WordPress version 1.4.6 contains an injected backdoor. This happened because the plugin was sold to a malicious threat actor who embedded a backdoor into all copies of the plugin they acquired.
This backdoor allows the attacker to maintain persistent unauthorized access to websites using the plugin.
Additionally, the attacker can inject spam into the affected sites.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized persistent access to your website by a malicious actor.
The attacker can inject spam content into your site, which can damage your site's reputation and SEO.
Given the high CVSS score of 9.8, the vulnerability poses a critical risk affecting confidentiality, integrity, and availability of your site.