CVE-2020-13644

MEDIUM 5.4CVE-2020-13644 · Published 28/05/2020 · updated 17/06/2026

In short

CVE-2020-13644 is a MEDIUM (CVSS 5.4) vulnerability affecting accordion (pickplugins).
Chance of exploitation in the next 30 days (EPSS): 0.77%, higher than 55.5% of all vulnerabilities.
Fix: update to 2.2.9 or later.

Package	Affected versions	Patched versions
accordion pickplugins	`< 2.2.9`	`2.2.9`

Description

An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.

References

wordpress.org/plugins/accordions · Release Notes
wordfence.com/blog/2020/04/vulnerability-patched-in-accordion-plugin · Exploit

More vulnerabilities in accordion

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free