CVE-2026-0727 describes an authorization bypass vulnerability (CWE-862) in the essentialplugin Accordion and Accordion Slider WordPress plugin versions up to 1.4.5. The plugin fails to properly verify user authorization in the 'wp_aas_save_attachment_data' and 'wp_aas_get_attachment_edit_form' functions. This allows authenticated users with contributor or higher privileges to read and modify metadata of any attachment on the site, including sensitive fields such as file paths and alt text. The vulnerability has a CVSS 3.1 base score of 5.4, reflecting a medium severity level with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with contributor-level access or higher can bypass authorization controls to access and modify attachment metadata across the site. This could lead to unauthorized disclosure and alteration of file-related information, potentially impacting site content integrity and confidentiality. There is no indication of impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor the vendor's communications for updates. Until a fix is available, limit contributor-level access to trusted users and consider additional access controls or plugin deactivation if feasible.