by Kastro
Paper/Archive/CVE-2026-6443

CVE-2026-6443

essentialplugin Accordion and Accordion Slider — Essentialplugin Plugins (Various Versions) - Injected Backdoor

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 42.5.425 × 208.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.

Affected

ProductAffectedFixed inSource
Accordion and Accordion Slider1.4.6–CNA
Portfolio and Projects1.5.6–CNA
Featured Post Creative1.5.7–CNA
Post grid and filter ultimate1.7.4–CNA
WP Featured Content and Slider1.7.6–CNA
Post Ticker Ultimate1.7.6–CNA
Trending/Popular Post Slider and Widget1.8.6–CNA
Meta Slider and Carousel with Lightbox2.0.8–CNA
Album and Image Gallery Plus Lightbox2.1.8–CNA
Timeline and History slider2.4.5–CNA
WP Blog and Widgets2.6.6–CNA
Countdown Timer Ultimate2.6.9–CNA

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/2597724a-9a39-4e46-b153-f42366f833ba?source=cverefanchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them