CVE-2026-0635 is a vulnerability identified in the Responsive Accordion Slider plugin for WordPress, developed by techknowprime. The root cause is a missing authorization check (CWE-862) in the function 'resp_accordion_silder_save_images', which is responsible for saving image metadata associated with sliders. This flaw exists in all versions up to and including 1.2.2. Because of this missing capability check, any authenticated user with Contributor-level privileges or higher can modify image metadata such as titles, descriptions, alt text, and hyperlinks within the slider component. This unauthorized modification can be leveraged to alter website content in a way that may mislead visitors, degrade user experience, or potentially facilitate social engineering or phishing attacks by changing links to malicious destinations. The vulnerability does not allow for data confidentiality breaches or denial of service but compromises data integrity. Exploitation requires the attacker to have at least Contributor access, which is a common role in WordPress allowing content creation but typically not administrative control. No user interaction beyond authentication is needed, and there are no known exploits in the wild as of the publication date. The CVSS v3.1 base score is 4.3, reflecting a medium severity level due to the limited scope and impact. Since the plugin is widely used in WordPress environments, especially in content-heavy websites, this vulnerability poses a risk to website content integrity and trustworthiness.

For European organizations, this vulnerability primarily threatens the integrity of website content managed via WordPress using the Responsive Accordion Slider plugin. Unauthorized modification of slider image metadata can lead to misinformation, brand damage, or redirection of users to malicious sites if links are altered. This can undermine user trust and potentially facilitate phishing or social engineering campaigns targeting customers or employees. While the vulnerability does not directly compromise sensitive data or availability, the reputational damage and potential downstream attacks could have significant operational and financial consequences. Organizations relying on WordPress for marketing, e-commerce, or customer engagement are particularly at risk. The requirement for Contributor-level access means insider threats or compromised lower-privilege accounts could exploit this flaw. Given the widespread use of WordPress across Europe, especially in small and medium enterprises, the impact could be broad if not mitigated.

Organizations should immediately audit WordPress user roles and restrict Contributor-level access to trusted users only. Implement the principle of least privilege to minimize the number of users who can modify content. Since no official patch is currently available, consider disabling or replacing the Responsive Accordion Slider plugin until a fix is released. Monitor website content for unauthorized changes, especially in slider images and associated metadata. Employ web application firewalls (WAFs) with custom rules to detect and block suspicious POST requests targeting the vulnerable function. Regularly update WordPress core and plugins to incorporate security patches once available. Additionally, implement multi-factor authentication (MFA) for all authenticated users to reduce the risk of account compromise. Conduct user training to raise awareness about the risks of unauthorized content changes and phishing attempts.