Read More & Accordion EUVD-2026-31035

Exploitation requires an authenticated session with WordPress administrator-level privileges (PR:H per CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). Additionally, the attacker must have access to the specific plugin admin pages that render the vulnerable views (readMorePagesView.php or accordionBuilder/list.php), which pass the orderby GET parameter to the affected functions. Sites that have configured the yrm-user-roles plugin setting to grant plugin admin page access to roles below administrator (e.g., editor or contributor) effectively lower the privilege requirement beyond what the CVSS PR:H rating reflects. Exploitation is not possible by unauthenticated users or standard subscriber/customer roles on default plugin configurations. The vulnerability is network-reachable (AV:N) and requires no user interaction beyond the attacker's own authenticated session.

The CVSS 4.9 medium score is primarily driven by the PR:H (high privilege) component of the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, which requires the attacker to already hold administrator-level access in WordPress. This significantly constrains real-world risk: a WordPress administrator already has nearly full site control via the dashboard, so the marginal gain from this vulnerability is primarily access to raw database credential hashes rather than an initial foothold. That said, the C:H rating is meaningful if the attacker's goal is lateral movement - extracting hashed credentials of other administrator accounts or harvesting data from custom database tables. The attack complexity is low (AC:L) and requires no user interaction (UI:N), so execution is straightforward once access conditions are met. No EPSS score was provided in the source data; given the PR:H constraint and absence of KEV or POC indicators, this vulnerability is lower priority than unauthenticated or low-privilege SQLi. However, sites that have configured the yrm-user-roles setting to grant plugin admin access to lower-privileged roles effectively lower the privilege bar below administrator, which could meaningfully raise practical risk beyond what the CVSS vector captures.

An attacker who has obtained WordPress administrator credentials - whether through phishing, credential stuffing, or password reuse - authenticates to the WordPress dashboard and navigates to a plugin admin page that invokes getAllDataByLimit() with the GET parameter orderby. The attacker submits a crafted value such as (SELECT SLEEP(5)) and observes a five-second response delay confirming blind injection, then iterates conditional subqueries to extract the wp_users table, recovering administrator password hashes for offline cracking. No public POC code has been identified at time of analysis, but the technique is a well-documented blind SQLi pattern requiring no specialized tooling beyond standard tools like sqlmap.