What is the CVSS score of EUVD-2026-31035?

EUVD-2026-31035 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Read More & Accordion EUVD-2026-31035

| CVE-2026-7472 MEDIUM

SQL Injection (CWE-89)

2026-05-20 Wordfence

GHSA-xf5m-hv2x-626c

WordPress PHP Information Disclosure SQLi

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:38 vuln.today

DescriptionCVE.org

The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.5.7. This is due to the use of esc_sql() without surrounding the value in quotes in an ORDER BY clause inside the getAllDataByLimit() and getAccordionAllDataByLimit() functions in ReadMoreData.php. The user-supplied $_GET['orderby'] value is only processed through esc_attr() (an HTML-escaping function) before being passed to these database functions, where esc_sql() is applied but the value is directly concatenated-unquoted-into the ORDER BY fragment of the SQL query before $wpdb->prepare() is called. Because esc_sql() only escapes quote characters and backslashes (which are irrelevant in an unquoted ORDER BY context), an attacker can inject arbitrary SQL expressions such as (SELECT SLEEP(5)) or conditional subqueries to perform time-based blind data extraction. This makes it possible for authenticated attackers with administrator-level access or above (or any role explicitly permitted access to the plugin's admin pages via the yrm-user-roles setting) to extract sensitive data from the database, including administrator credential hashes.

AnalysisAI

Time-based blind SQL injection in the Read More & Accordion WordPress plugin (slug: expand-maker) through version 3.5.7 enables authenticated administrators to exfiltrate arbitrary database contents, including administrator password hashes, by manipulating the orderby GET parameter. The flaw exists in two data-retrieval functions in ReadMoreData.php, where user input bypasses effective sanitization and is concatenated unquoted into an ORDER BY SQL clause. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the high-confidentiality CVSS impact (C:H) reflects genuine data-exposure potential.

Technical ContextAI

The affected plugin (CPE: cpe:2.3:a:edmonparker:read_more_&_accordion:*:*:*:*:*:*:*:*) registers admin-facing pages that pass the raw $_GET['orderby'] value through esc_attr() - an HTML-encoding function designed for attribute output, not SQL safety - before handing it to getAllDataByLimit() and getAccordionAllDataByLimit() in ReadMoreData.php (lines 1522 and 1537 of the 3.5.7 tag). Inside those functions, esc_sql() is applied, but because the value is concatenated directly and unquoted into the ORDER BY fragment before $wpdb->prepare() is invoked, the escaping is entirely ineffective: esc_sql() only strips quotes and backslashes, which are irrelevant in a bare ORDER BY context. This is the canonical CWE-89 (Improper Neutralization of Special Elements in SQL Commands) pattern where a developer confuses an HTML-escaping helper with a SQL-safe quoting mechanism. The structural fix is to whitelist acceptable column names rather than attempt escaping on a free-form ORDER BY token.

RemediationAI

No vendor-released patch has been identified at time of analysis - the available references point only to the vulnerable 3.5.7 tagged release and trunk code, with no fix commit or updated release confirmed. Site owners should monitor the WordPress plugin repository for an updated release and apply it immediately upon availability. As a compensating control, administrators should audit the yrm-user-roles plugin setting and restrict it to the minimum required roles, reducing the number of accounts that can reach the vulnerable admin pages; note that this does not eliminate risk for sites with multiple administrator accounts. Additionally, a web application firewall (WAF) rule blocking ORDER BY injection patterns (e.g., SQL keywords or time-delay functions in the orderby parameter) can reduce exposure, though WAF rules can be bypassed and should not substitute for a code-level fix. If the plugin is not actively required, temporarily deactivating it eliminates the attack surface entirely with no functional trade-off for non-users.