---
id: "CVE-2026-116392"
kind: "vulnerability"
aliases: ["CVE-2026-116392"]
title: "PickPlugins Accordion WordPress plugin: untrusted data deserialization allows object injection"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["accordions", "package", "php", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-28T13:17:05+00:00"
first_seen_at: "2026-10-28T13:33:01+00:00"
updated_at: "2026-10-28T13:34:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116392", "first_seen_at": "2026-10-28T13:33:01+00:00"}]
---

# PickPlugins Accordion WordPress plugin: untrusted data deserialization allows object injection

The PickPlugins Accordion plugin for WordPress deserializes untrusted data, which lets an attacker inject PHP objects. The sources do not say what gadget chain or outcome follows beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Accordion plugin (accordions) in the WordPress admin plugins page or `wp plugin get accordions --field=version`
- unknown

## Fix

- Update the Accordion plugin (accordions) to a version newer than `2.3.25`, once the vendor publishes one; the sources do not name a fixed version
- unknown

## Timeline

- 2026-10-28T13:33:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116392

## From the sources

Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_