CVE-2026-7472
Read More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
Description
The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.5.7. This is due to the use of esc_sql() without surrounding the value in quotes in an ORDER BY clause inside the getAllDataByLimit() and getAccordionAllDataByLimit() functions in ReadMoreData.php. The user-supplied $_GET['orderby'] value is only processed through esc_attr() (an HTML-escaping function) before being passed to these database functions, where esc_sql() is applied but the value is directly concatenated—unquoted—into the ORDER BY fragment of the SQL query before $wpdb->prepare() is called. Because esc_sql() only escapes quote characters and backslashes (which are irrelevant in an unquoted ORDER BY context), an attacker can inject arbitrary SQL expressions such as (SELECT SLEEP(5)) or conditional subqueries to perform time-based blind data extraction. This makes it possible for authenticated attackers with administrator-level access or above (or any role explicitly permitted access to the plugin's admin pages via the yrm-user-roles setting) to extract sensitive data from the database, including administrator credential hashes.
INFO
Published Date :
May 20, 2026, 2:16 a.m.
Last Modified :
July 24, 2026, 1:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the Read More & Accordion plugin.
- Apply available security patches from the vendor.
- Review plugin configurations for security settings.
- Restrict access to plugin admin pages.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-7472.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-7472 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-7472
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-7472 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-7472 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 24, 2026
Action Type Old Value New Value Added Translation Title: plugin de WordPress Read More & Accordion, Description: El plugin Read More & Accordion para WordPress es vulnerable a inyección SQL ciega basada en tiempo a través del parámetro 'orderby' en todas las versiones hasta la 3.5.7, inclusive. Esto se debe al uso de esc_sql() sin rodear el valor entre comillas en una cláusula ORDER BY dentro de las funciones getAllDataByLimit() y getAccordionAllDataByLimit() en ReadMoreData.php. El valor parámetro 'orderby' proporcionado por el usuario solo se procesa a través de esc_attr() (una función de escape de HTML) antes de ser pasado a estas funciones de base de datos, donde se aplica esc_sql() pero el valor se concatena directamente -sin comillas- en el fragmento ORDER BY de la consulta SQL antes de que se llame a $wpdb -> prepare(). Debido a que esc_sql() solo escapa caracteres de comillas y barras invertidas (que son irrelevantes en un contexto ORDER BY sin comillas), un atacante puede inyectar expresiones SQL arbitrarias como ([SQL_SLEEP_STATEMENT]) o subconsultas condicionales para realizar una extracción de datos ciega basada en tiempo. Esto hace posible que atacantes autenticados con acceso de nivel de administrador o superior (o cualquier rol al que se le haya permitido explícitamente el acceso a las páginas de administración del plugin a través de la configuración yrm-user-roles) extraigan datos sensibles de la base de datos, incluyendo hashes de credenciales de administrador. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'edmonparker', 'product': 'Read More & Accordion', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '3.5.7'}], 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-7472', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-05-20T17:16:22.722056Z'} -
New CVE Received by [email protected]
May. 20, 2026
Action Type Old Value New Value Added Description The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.5.7. This is due to the use of esc_sql() without surrounding the value in quotes in an ORDER BY clause inside the getAllDataByLimit() and getAccordionAllDataByLimit() functions in ReadMoreData.php. The user-supplied $_GET['orderby'] value is only processed through esc_attr() (an HTML-escaping function) before being passed to these database functions, where esc_sql() is applied but the value is directly concatenated—unquoted—into the ORDER BY fragment of the SQL query before $wpdb->prepare() is called. Because esc_sql() only escapes quote characters and backslashes (which are irrelevant in an unquoted ORDER BY context), an attacker can inject arbitrary SQL expressions such as (SELECT SLEEP(5)) or conditional subqueries to perform time-based blind data extraction. This makes it possible for authenticated attackers with administrator-level access or above (or any role explicitly permitted access to the plugin's admin pages via the yrm-user-roles setting) to extract sensitive data from the database, including administrator credential hashes. Added CVSS V3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Added CWE CWE-89 Added Reference https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/classes/ReadMoreData.php#L1522 Added Reference https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/classes/ReadMoreData.php#L1537 Added Reference https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/views/accordionBuilder/list.php#L29 Added Reference https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/views/readMorePagesView.php#L29 Added Reference https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMoreData.php#L1522 Added Reference https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMoreData.php#L1537 Added Reference https://plugins.trac.wordpress.org/browser/expand-maker/trunk/views/accordionBuilder/list.php#L29 Added Reference https://plugins.trac.wordpress.org/browser/expand-maker/trunk/views/readMorePagesView.php#L29 Added Reference https://www.wordfence.com/threat-intel/vulnerabilities/id/cc7c7e21-fbd7-4451-bc7d-3d11db01a443?source=cve