Executive brief
The Read More & Accordion plugin for WordPress, which is used to create expandable content sections on websites, contains a security vulnerability that allows authorized users to access sensitive database information. By exploiting this flaw, an attacker with administrative or specific plugin access can extract private data, including encrypted password hashes for other site administrators. This could lead to a full takeover of the website if the extracted credentials are successfully cracked.
Technical details
The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL injection due to improper sanitization of the 'orderby' parameter in the getAllDataByLimit() and getAccordionAllDataByLimit() functions within ReadMoreData.php. While the plugin uses esc_sql(), it fails to wrap the resulting value in quotes within the ORDER BY clause, allowing attackers to bypass the escaping mechanism which only targets quotes and backslashes. An authenticated attacker with administrator-level privileges (or roles granted access via yrm-user-roles) can inject arbitrary SQL expressions, such as SLEEP() commands, to extract sensitive data from the database. The vulnerability exists in all versions up to and including 3.5.7.
Affected products
- WordPress Read More & Accordion Up to, and including, 3.5.7
Timeline
- 2026-05-20: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/classes/ReadMoreData.php
- https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/classes/ReadMoreData.php
- https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/views/accordionBuilder/list.php
- https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/views/readMorePagesView.php
- https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMoreData.php
- https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMoreData.php
- https://plugins.trac.wordpress.org/browser/expand-maker/trunk/views/accordionBuilder/list.php