Read More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
medium
The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.5.7. This is due to the use of esc_sql() without surrounding the value in quotes in an ORDER BY clause inside the getAllDataByLimit() and getAccordionAllData...
- CVSS:
- 4.9
- Affected:
- up to 3.5.7
- Fix:
- No patched version reported
- Disclosed:
- May 19, 2026
CVE-2026-7472 on NVD →
Read More & Accordion <= 3.5.7 - Privilege Escalation via importData
high
The Read More & Accordion plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.7. This is due to the 'RadMoreAjax::importData' function not restricting which database tables can be written to during import and not properly validating the imported data. This makes it possi...
- CVSS:
- 8.8
- Affected:
- up to 3.5.7
- Fix:
- No patched version reported
- Disclosed:
- May 19, 2026
CVE-2026-7467 on NVD →
Read More & Accordion <= 3.5.5.1 - Missing Authorization
medium
The Read More & Accordion plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.5.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
- CVSS:
- 4.3
- Affected:
- up to 3.5.5.1
- Fixed in:
- 3.5.6
- Disclosed:
- Dec 15, 2025
CVE-2025-64247 on NVD →
Read More & Accordion <= 3.4.7 - Cross-Site Request Forgery to Local File Inclusion
high
The Read More & Accordion plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.7. This is due to missing or incorrect nonce validation on the addNewButtons() function. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files vi...
- CVSS:
- 7.5
- Affected:
- up to 3.4.7
- Fixed in:
- 3.4.8
- Disclosed:
- Apr 4, 2025
CVE-2025-0810 on NVD →
Read More & Accordion <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post Deletion
medium
The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the expmDeleteData() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...
- CVSS:
- 4.3
- Affected:
- up to 3.4.2
- Fixed in:
- 3.4.3
- Disclosed:
- Feb 12, 2025
CVE-2024-13639 on NVD →
Read More & Accordion <= 3.2.6.1 - Authenticated (Administrator+) PHP Object Injection
high
The Read More & Accordion plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.2.6.1 via deserialization of untrusted input from admin settings. This allows authenticated attackers, with administrator-level privileges and above, to inject a PHP Object. If a POP chain is present...
- CVSS:
- 7.2
- Affected:
- up to 3.2.6.1
- Fixed in:
- 3.2.7
- Disclosed:
- Sep 11, 2023
CVE-2023-3392 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database