CVE-2025-53421 - Vulnerability Details - OpenCVE

Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Pickplugins	Accordion
Wordpress	Wordpress

No data.

No data.

References

Link	Providers
https://vdp.patchstack.com/database/Wordpress/Plugin/accordions/vulnerability/wordpress-accordion-plugin-2-3-14-broken-access-control-vulnerability-2

History

Thu, 23 Oct 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 23 Oct 2025 10:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Pickplugins Pickplugins accordion Wordpress Wordpress wordpress
Vendors & Products		Pickplugins Pickplugins accordion Wordpress Wordpress wordpress

Wed, 22 Oct 2025 14:45:00 +0000

Type	Values Removed	Values Added
Description		Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14.
Title		WordPress Accordion plugin <= 2.3.14 - Broken Access Control vulnerability
Weaknesses		CWE-862
References		https://vdp.patchstack.com/database/Wordpress/Plugin/accordions/vulnerability/wordpress-accordion-plugin-2-3-14-broken-access-control-vulnerability-2

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2025-10-22T14:32:32.545Z

Updated: 2025-10-23T16:14:18.243Z

Reserved: 2025-06-30T10:46:02.700Z

Link: CVE-2025-53421

Vulnrichment

Updated: 2025-10-23T13:47:38.782Z

NVD

Status : Awaiting Analysis

Published: 2025-10-22T15:15:49.437

Modified: 2025-10-23T17:15:38.370

Link: CVE-2025-53421

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-53421", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-06-30T10:46:02.700Z", "datePublished": "2025-10-22T14:32:32.545Z", "dateUpdated": "2025-10-23T16:14:18.243Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "accordions", "product": "Accordion", "vendor": "PickPlugins", "versions": [{"changes": [{"at": "2.3.16", "status": "unaffected"}], "lessThanOrEqual": "<= 2.3.14", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Abu Hurayra (Patchstack Alliance)"}], "datePublic": "2025-10-22T15:51:50.474Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Accordion: from n/a through <= 2.3.14.</p>"}], "value": "Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-10-22T14:32:32.545Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/accordions/vulnerability/wordpress-accordion-plugin-2-3-14-broken-access-control-vulnerability-2"}], "title": "WordPress Accordion plugin <= 2.3.14 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-23T13:47:18.454265Z", "id": "CVE-2025-53421", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-23T16:14:18.243Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-53421", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-23T13:47:18.454265Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-23T13:47:38.782Z"}}], "cna": {"title": "WordPress Accordion plugin <= 2.3.14 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Abu Hurayra (Patchstack Alliance)"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "PickPlugins", "product": "Accordion", "versions": [{"status": "affected", "changes": [{"at": "2.3.16", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "<= 2.3.14"}], "packageName": "accordions", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2025-10-22T15:51:50.474Z", "references": [{"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/accordions/vulnerability/wordpress-accordion-plugin-2-3-14-broken-access-control-vulnerability-2", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Accordion: from n/a through <= 2.3.14.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-10-22T14:32:32.545Z"}}}, "cveMetadata": {"cveId": "CVE-2025-53421", "state": "PUBLISHED", "dateUpdated": "2025-10-23T13:47:44.972Z", "dateReserved": "2025-06-30T10:46:02.700Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2025-10-22T14:32:32.545Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}