CVE-2025-62130

The Accordion Slider Gallery plugin for WordPress, versions up to and including 2.7, suffers from a missing authorization vulnerability. This flaw stems from incorrectly configured access control security levels, allowing exploitation of broken access controls [1].

Attackers can exploit this vulnerability without authentication, as the plugin fails to properly verify user permissions for certain functions. The attack surface is broad, as the plugin is widely used, and the vulnerability can be leveraged in mass-exploit campaigns targeting thousands of sites regardless of their size or popularity.

Successful exploitation enables an unprivileged user to execute higher-privileged actions, potentially leading to unauthorized data access or modification. The CVSS score of 4.3 (Medium) reflects the moderate impact, though the ease of exploitation in mass campaigns increases the risk.

Users are strongly advised to update the plugin immediately. If updating is not possible, contacting a hosting provider or web developer for assistance is recommended. No workaround details are provided in the advisory.