CVE-2026-7467

The Read More & Accordion plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.7. This is due to the 'RadMoreAjax::importData' function not restricting which database tables can be written to during import and not properly validating the imported data. This makes it possible for authenticated attackers, with permission granted by the site owner through the plugin's role settings, to insert arbitrary rows into the 'wp_users' and 'wp_usermeta' tables, including the 'wp_capabilities' field, allowing them to create a new administrator account and gain administrator access to the site.

• CWE-269

• https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.5/files/RadMoreAjax.php#L62
• https://www.wordfence.com/threat-intel/vulnerabilities/id/adf51c03-b0bb-4864-b64d-6b0cba4b0130?source=cve

Published

May 20, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7460mailcow-dockerized contains a stored cross-site scripting vu…7.4
• CVE-2026-7461Improper neutralization of inputs used in an OS command in t…7.5
• CVE-2026-7462The VatanSMS WP SMS plugin for WordPress is vulnerable to Re…6.1
• CVE-2026-7464The WP Google Maps Integration plugin for WordPress is vulne…6.1
• CVE-2026-7465The Spectra Gutenberg Blocks – Website Builder for the Block…8.8
• CVE-2026-7466AgentFlow contains an arbitrary code execution vulnerability…8.8
• CVE-2026-7468A security vulnerability has been detected in 1024-lab smart…7.3
• CVE-2026-7469A vulnerability was detected in Tenda 4G300 US_4G300V1.0Mt_V…6.3
• CVE-2026-7470A flaw has been found in Tenda 4G300 US_4G300V1.0Mt_V1.01.42…8.8
• CVE-2026-7471GitLab has remediated an issue in GitLab EE affecting all ve…3.5
• CVE-2026-7472The Read More & Accordion plugin for WordPress is vulnerable…4.9
• CVE-2026-7473On affected platforms running Arista EOS where a tunnel deca…6.9