# CVE-2022-33198: Accordions (WordPress plugin) - Missing Authorization

> Live exploitation tracking for CVE-2022-33198 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-33198

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Biplob Adhikari Accordions (WordPress plugin)
- **Weaknesses:** CWE-264 (Permissions, Privileges, and Access Controls)
- **Tags:** cms, wordpress

## Description

Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.

## CrowdSec analysis

[CVE-2022-33198](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-33198) is a critical vulnerability in the Accordions WordPress plugin by Biplob Adhikari, allowing unauthenticated attackers to change WordPress options remotely. This flaw could be exploited to compromise site configuration, potentially leading to privilege escalation, data loss, or full site takeover.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2022-33198 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit unauthenticated POST requests to `/wp-json/oxiaccordionsultimate/v1/oxi_settings` to update plugin settings, allowing them to modify site options without authentication.

## Timeline

- 2022-07-21: CVE Published. CVE-2022-33198 is published to NVD.
- 2025-12-10: Rule Released. CrowdSec releases a rule to detect CVE-2022-33198 exploitation attempts against the CrowdSec Network.
- 2025-12-18: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-33198 for the first time.

## References

- https://patchstack.com/database/vulnerability/accordions-or-faqs/wordpress-accordions-plugin-2-0-2-unauthenticated-wordpress-options-change-vulnerability
- https://wordpress.org/plugins/accordions-or-faqs/#developers
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33198.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-33198) follows observed exploitation activity for CVE-2022-33198. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.