CVE-2020-13644: 
WordPress vulnerability analysis and mitigation

An issue was discovered in the WordPress Accordion plugin before version 2.2.9. The vulnerability involved an unprotected AJAX action (wp_ajax_accordions_ajax_import_json) that allowed any authenticated user with Subscriber or higher permissions to import new accordions and inject malicious JavaScript code (NVD, CVE Mitre).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue. It received a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction, with potential impact on confidentiality and integrity (NVD).

The vulnerability could allow attackers to inject malicious JavaScript code through the accordion import functionality, potentially leading to cross-site scripting attacks. This could result in the theft of sensitive information or manipulation of web content for authenticated users (NVD).

The vulnerability requires an attacker to have an authenticated account with at least Subscriber-level permissions on the WordPress installation. The exploit involves manipulating the accordion import functionality to inject malicious JavaScript code (Wordfence).

Users should update their Accordion plugin to version 2.2.9 or later to address this vulnerability. The patch was released promptly after the disclosure (WordPress Plugin).