The PickPlugins Accordion plugin suffers from a missing authorization vulnerability in versions up to 2.3.15. This issue arises from incorrectly configured access control security levels, allowing attackers with low privileges to access sensitive information without proper authorization. The vulnerability is network exploitable, requires low privileges, and does not require user interaction. Confidentiality is impacted, but integrity and availability remain unaffected. No official patch or vendor advisory has been provided to date.

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information due to missing authorization checks. The impact is limited to confidentiality, with no effect on integrity or availability. Since the vulnerability requires low privileges and no user interaction, it could be leveraged by authenticated users to escalate access to restricted data. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations for the PickPlugins Accordion plugin to ensure proper authorization enforcement. Limit user privileges where possible to reduce risk exposure.