{"id":"CVE-2026-116392","kind":"vulnerability","aliases":["CVE-2026-116392"],"related":[],"title":"PickPlugins Accordion WordPress plugin: untrusted data deserialization allows object injection","description":"Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25.","summary":"The PickPlugins Accordion plugin for WordPress deserializes untrusted data, which lets an attacker inject PHP objects. The sources do not say what gadget chain or outcome follows beyond that.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["accordions","package","php","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Accordion plugin (accordions) in the WordPress admin plugins page or `wp plugin get accordions --field=version`\n- unknown","fix":"- Update the Accordion plugin (accordions) to a version newer than `2.3.25`, once the vendor publishes one; the sources do not name a fixed version\n- unknown","status":"open","published_at":"2026-10-28T13:17:05+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:34:08+00:00","updated_at":"2026-10-28T13:34:08+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-28T13:34:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Accordion plugin (accordions) to a version newer than `2.3.25`, once the vendor publishes one; the sources do not name a fixed version\n- unknown","reach":"unknown","title":"PickPlugins Accordion WordPress plugin: untrusted data deserialization allows object injection","impact":"high","summary":"The PickPlugins Accordion plugin for WordPress deserializes untrusted data, which lets an attacker inject PHP objects. The sources do not say what gadget chain or outcome follows beyond that.","category":"package","nicknames":[],"who_cares":["wordpress","php","accordions"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; object injection may allow code execution depending on available gadget chains","analyst_note":"Confirm the fixed version, whether authentication is required, and the exact deserialization entry point from the NVD entry or the vendor advisory.","how_to_check":"- Check the installed version of the Accordion plugin (accordions) in the WordPress admin plugins page or `wp plugin get accordions --field=version`\n- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the PickPlugins Accordion plugin (accordions) at version `2.3.25` or earlier are affected. Sites without this plugin installed are not affected. The sources do not describe further conditions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000591,"input_tokens":3283,"output_tokens":526,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116392':13A,16A '-2026':12A,15A '2.3.25':67C 'accordion':2A,17B,23B,56C,57C,63C 'affect':62C 'allow':8A,58C 'attack':33B 'beyond':48B 'chain':44B 'cve':11A,14A 'data':6A,29B,52C 'deseri':7A,27B,49C 'follow':47B 'gadget':43B 'inject':10A,34B 'injection.this':60C 'issu':61C 'let':31B 'n/a':65C 'object':9A,36B,59C 'outcom':46B 'packag':18B 'php':19B,35B 'pickplugin':1A,22B,55C 'plugin':4A,24B 'say':41B 'sourc':38B 'untrust':5A,28B,51C 'vulner':53C 'wordpress':3A,20B,26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the PickPlugins Accordion plugin (accordions) at version `2.3.25` or earlier are affected. Sites without this plugin installed are not affected. The sources do not describe further conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116392","severity":null,"published_at":"2026-10-28T13:17:05+00:00","modified_at":"2026-10-28T13:17:05+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}