Read More & Accordion CVE-2026-7467

Exploitation requires an authenticated WordPress account (CVSS PR:L) on a site where the administrator has explicitly delegated the Read More & Accordion plugin's import capability to a non-administrator role through the plugin's own role settings - a non-default configuration choice the site owner must make. The vulnerable RadMoreAjax::importData handler must be reachable over the network (it is, via standard WordPress admin-ajax), no user interaction beyond the attacker's own request is needed (UI:N), and the target site must be running Read More & Accordion version 3.5.7 or earlier. Exploitation is limited by the fact that default installations without delegated import permissions are not exposed to lower-privileged attackers, so anonymous internet attackers and standard subscriber accounts on default-configured sites cannot reach the sink.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures network-reachable, low-complexity, authenticated exploitation with full CIA impact, since administrator takeover is the documented outcome. The PR:L requirement is meaningful: an attacker must already hold an account that the site owner explicitly granted plugin import permission to via the plugin's role settings - this is not anonymous remote exploitation, which significantly narrows the exposed population to multi-author or membership sites that delegate plugin operations. EPSS, KEV, and SSVC signals were not provided in the input, and no public exploit was identified at time of analysis, so quantitative exploitation likelihood cannot be cited. Compared with classic unauthenticated WordPress plugin RCE/PE bugs, this issue's real-world urgency is somewhat lower because of the PR:L gate, but the impact ceiling (full site takeover) and the trivial post-auth complexity keep it firmly in the high-priority remediation tier for any site that has actually configured the plugin's role permissions for non-administrator users.

An attacker who has been granted a low-privileged WordPress account on a target site where the owner has enabled the Read More & Accordion plugin's import permission for non-admin roles sends a crafted import payload to the RadMoreAjax::importData AJAX endpoint, targeting the wp_users and wp_usermeta tables. The payload inserts a new user row plus a wp_capabilities meta entry granting the administrator role, and the attacker then logs in as that new administrator and pivots to plugin/theme upload for full code execution on the underlying host. No public exploit code has been identified at time of analysis.