Vulnerability · Published May 28, 2020 · Assigned by mitre
CVE-2020-13644
Medium 5.4
In plain English
A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.0)5.4Medium
Exploit odds (30 days)0.8%top 44.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.
Affected products (as reported)
References
- https://www.wordfence.com/blog/2020/04/vulnerability-patched-in-accordion-plugin/ x_refsource_MISC
- https://wordpress.org/plugins/accordions/#developers x_refsource_MISC