What is the CVSS score of CVE-2026-7467?

CVE-2026-7467 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Read More & Accordion are affected by CVE-2026-7467?

The Read More & Accordion WordPress plugin (versions ≤3.5.7) contains a privilege escalation vulnerability allowing authenticated users with import permissions to create unauthorized administrator…

How to fix or mitigate CVE-2026-7467?

Within 24 hours: Audit all WordPress installations for Read More & Accordion plugin version ≤3.5.7 and assess production criticality; immediately disable the plugin's import functionality or uninstall entirely if not operationally required. Within 7 days: For installations requiring this plugin, restrict the 'import' capability to administrator-only accounts through WordPress role management and implement monitoring for unauthorized modifications to wp_users and wp_usermeta tables. Within 30 days: Monitor Wordfence security advisory and official plugin repository for vendor patch release to version 3.5.8 or later; prepare migration strategy to alternative accordion/expandable content plugins.

Read More & Accordion CVE-2026-7467

EUVD-2026-31030 HIGH

Improper Privilege Management (CWE-269)

2026-05-20 Wordfence

GHSA-q5wm-43c6-48m3

WordPress Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:31 vuln.today

DescriptionCVE.org

The Read More & Accordion plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.7. This is due to the 'RadMoreAjax::importData' function not restricting which database tables can be written to during import and not properly validating the imported data. This makes it possible for authenticated attackers, with permission granted by the site owner through the plugin's role settings, to insert arbitrary rows into the 'wp_users' and 'wp_usermeta' tables, including the 'wp_capabilities' field, allowing them to create a new administrator account and gain administrator access to the site.

AnalysisAI

Privilege escalation in the Read More & Accordion WordPress plugin (versions up to and including 3.5.7) allows authenticated low-privileged users granted import rights through the plugin's role settings to write arbitrary rows into the wp_users and wp_usermeta tables, effectively creating a new administrator account. The flaw stems from the RadMoreAjax::importData function failing to restrict target database tables and to validate imported data. No public exploit identified at time of analysis, though the vulnerability was disclosed by Wordfence threat intelligence researchers.

Technical ContextAI

The affected component is a WordPress plugin (CPE cpe:2.3:a:edmonparker:read_more_&_accordion) that provides expandable content blocks and accordion UI elements. The RadMoreAjax.php file (visible in plugins.trac.wordpress.org at line 62 of the 3.5.5 tag) implements an AJAX import handler that accepts plugin configuration data and writes it to the WordPress database. CWE-269 (Improper Privilege Management) is the root cause class: the import routine treats user-supplied table names and row payloads as trusted, so a caller authorized only for plugin-content import can pivot the same write primitive against wp_users and wp_usermeta, which WordPress core treats as authoritative for identity and role assignment (wp_capabilities meta key).

RemediationAI

No vendor-released patch identified at time of analysis; the references include the Wordfence advisory and the wordpress.org plugin source repository but do not cite a fixed version beyond 3.5.7. Until a fixed release is published, site operators should deactivate and remove the Read More & Accordion plugin, or at minimum revoke the plugin's role-settings permission from all non-administrator roles so that only trusted administrators can call the import endpoint (side effect: content editors lose the ability to import plugin data). Defenders can additionally add a web application firewall rule blocking POST requests to the plugin's admin-ajax action used by RadMoreAjax::importData and audit the wp_users and wp_usermeta tables (especially the wp_capabilities meta key) for unexpected administrator entries. Monitor https://www.wordfence.com/threat-intel/vulnerabilities/id/adf51c03-b0bb-4864-b64d-6b0cba4b0130?source=cve and the plugin's WordPress.org page for a patched release and upgrade immediately when one becomes available.