CVE-2026-0635 Overview
CVE-2026-0635 affects the Responsive Accordion Slider plugin for WordPress in all versions up to and including 1.2.2. The vulnerability stems from a missing capability check on the resp_accordion_silder_save_images function. Authenticated users with Contributor-level access or higher can modify slider image metadata they should not be permitted to change. Affected fields include image titles, descriptions, alt text, and links. The flaw is classified under CWE-862: Missing Authorization.
Critical Impact
Contributor-level WordPress users can tamper with any slider's image metadata, including links, enabling content manipulation and potential redirection of site visitors to attacker-controlled destinations.
Affected Products
- Responsive Accordion Slider plugin for WordPress
- All versions up to and including 1.2.2
- WordPress sites granting Contributor-level access or above to untrusted users
Discovery Timeline
- 2026-01-14 - CVE-2026-0635 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-0635
Vulnerability Analysis
The Responsive Accordion Slider plugin exposes an administrative save function without verifying the caller's privileges. The resp_accordion_silder_save_images function in class-ras-admin.php accepts requests from any authenticated user but does not call WordPress capability functions such as current_user_can() before persisting changes. Any logged-in user with at least Contributor permissions can submit requests that overwrite slider image metadata. Attackers can replace legitimate hyperlinks with malicious URLs, alter alt text used for accessibility, or rewrite captions and descriptions visible to site visitors. The vulnerability does not expose data confidentiality but compromises content integrity on affected sites.
Root Cause
The root cause is a missing authorization check [CWE-862] on a state-changing administrative endpoint. The plugin assumes that authentication alone is sufficient to invoke resp_accordion_silder_save_images, but WordPress role hierarchy requires explicit capability validation. Functions that modify shared site content must verify that the calling user holds an appropriate capability such as edit_others_posts or manage_options. Without that check, low-privilege roles inherit administrative write access to slider metadata.
Attack Vector
Exploitation requires network access and an authenticated session at the Contributor role or higher. The attacker sends a crafted POST request to the plugin's admin-ajax or admin handler that invokes resp_accordion_silder_save_images with parameters specifying the target slider identifier and replacement metadata fields. The server processes the request and saves the modified values. No user interaction from an administrator is required. For technical details, review the vulnerable code at the WordPress Plugin Source Code and the Wordfence Vulnerability Report.
Detection Methods for CVE-2026-0635
Indicators of Compromise
- Unexpected modifications to slider image titles, captions, alt text, or destination links in WordPress posts and pages using the plugin.
- POST requests to admin-ajax.php or plugin admin endpoints referencing resp_accordion_silder_save_images originating from Contributor or Author accounts.
- Outbound links on rendered slider images pointing to unfamiliar domains.
Detection Strategies
- Review WordPress audit logs for invocations of the resp_accordion_silder_save_images function by non-Editor and non-Administrator users.
- Compare current slider image metadata against known-good backups to identify unauthorized edits.
- Inspect web server access logs for repeated POST requests to plugin endpoints from low-privilege user sessions.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to capture metadata changes and the user accounts responsible.
- Alert on metadata modifications performed by accounts that do not normally edit slider content.
- Monitor newly added or changed outbound URLs in slider content for blocklisted or newly registered domains.
How to Mitigate CVE-2026-0635
Immediate Actions Required
- Update the Responsive Accordion Slider plugin to a version later than 1.2.2 once the vendor releases a fix.
- Audit existing Contributor, Author, and Editor accounts and remove any that are unnecessary or inactive.
- Review all slider image metadata for unauthorized changes and restore legitimate values from backup.
Patch Information
At the time of publication, the vulnerability affects all versions up to and including 1.2.2. Site administrators should monitor the Wordfence Vulnerability Report and the plugin's WordPress.org listing for patched releases and apply the update as soon as it becomes available.
Workarounds
- Deactivate the Responsive Accordion Slider plugin until a patched version is released if Contributor-level accounts exist on the site.
- Restrict registration to trusted users and require administrator approval before granting Contributor or higher roles.
- Deploy a web application firewall rule to block requests invoking resp_accordion_silder_save_images from users below the Editor role.
# Configuration example: disable the plugin via WP-CLI until a patch is available
wp plugin deactivate responsive-accordion-slider
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
