CVE-2025-58024

HighCVSS 7.5

Published: 02/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

PHP Remote File Inclusion vulnerability in the Accordion FAQ plugin for WordPress up to version 2.2.1. Allows PHP Local File Inclusion.

Risk Assessment

Risk of remote code execution and WordPress server compromise.

Recommendation

Update the Accordion FAQ plugin to the latest version or remove it if not essential.

Other vulnerabilities in Accordion FAQ

CVE-2025-52759High
The Accordion FAQ plugin by UnboundStudio versions up to 2.2.1 has a Reflected XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious script via a crafted URL, which executes in the victim's browser.

Original NVD description (English source)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnboundStudio Accordion FAQ allows PHP Local File Inclusion. This issue affects Accordion FAQ: from n/a through 2.2.1.