Executive brief
Accordion FAQ is a WordPress plugin used to create and manage collapsible content sections on websites. A security vulnerability in this plugin allows an attacker with basic user permissions to access sensitive internal files on the web server. This could lead to the exposure of database credentials or other configuration data, potentially resulting in a full site takeover.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the UnboundStudio Accordion FAQ plugin for WordPress (versions up to and including 2.2.1). The flaw stems from improper validation of user-supplied input used in PHP include or require statements (CWE-98). An authenticated attacker with 'Contributor' level privileges can exploit this over the network to include local files from the server. Successful exploitation can lead to the disclosure of sensitive information, such as the wp-config.php file containing database credentials, or potentially remote code execution if the attacker can upload or influence the contents of a local file. As of the advisory date, no official patch has been released.
Affected products
- UnboundStudio Accordion FAQ n/a through 2.2.1
Timeline
- 2025-07-29: other: Vulnerability reported by researcher
- 2025-09-22: advisory: Patchstack published initial advisory
- 2026-06-02: disclosed: CVE published to NVD