CVE-2026-116392

CVE-2026-116392 · WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25.

CVSS 7.2 · High · EPSS 0.3%

Published: 2026-10-28T13:00:28.367Z
Updated: 2026-10-29T13:47:38.092Z

Affected products and versions

accordion
Versions
- ≥ 0, ≤ 2.3.25: Affected (custom)
No fix published

Original sources

https://patchstack.com/database/wordpress/plugin/accordions/vulnerability/wordpress-accordion-plugin-2-3-25-php-object-injection-vulnerability?_s_id=cve
https://nvd.nist.gov/vuln/detail/CVE-2026-116392

Check your server →