Executive brief
The Read More & Accordion plugin for WordPress, which is used to create expandable content sections on websites, contains a security flaw that allows certain users to upgrade their own account permissions. By exploiting a weakness in the plugin's data import feature, an attacker with basic site access can create a new administrator account. This gives the attacker full control over the website, allowing them to steal data, modify content, or lock out the legitimate owners.
Technical details
The 'RadMoreAjax::importData' function in the Read More & Accordion plugin for WordPress fails to restrict which database tables can be written to and does not properly validate imported data. This vulnerability allows authenticated attackers—who have been granted specific permissions via the plugin's role settings—to perform arbitrary database inserts. Specifically, an attacker can insert rows into the 'wp_users' and 'wp_usermeta' tables, including the 'wp_capabilities' field. This enables the creation of a new user with administrator privileges, leading to a complete site takeover. The issue affects all versions up to and including 3.5.7.
Affected products
- Expand Maker Read More & Accordion Up to, and including, 3.5.7
Timeline
- 2026-05-20: advisory: NVD publication date