Live › vulnerability › CVE-2026-116392
Go to dashboardThe PickPlugins Accordion plugin for WordPress deserializes untrusted data, which lets an attacker inject PHP objects. The sources do not say what gadget chain or outcome follows beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Sites running the PickPlugins Accordion plugin (accordions) at version 2.3.25 or earlier are affected. Sites without this plugin installed are not affected. The sources do not describe further conditions.
No product ranges from the sources yet.
wp plugin get accordions --field=version2.3.25, once the vendor publishes one; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25.
This page as .md · .json · in your agent: get_signal("CVE-2026-116392")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.