CVE Explorer

CVE-2026-7472

The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.5.7. This is due to the use of esc_sql() without surrounding the value in quotes in an ORDER BY clause inside the getAllDataByLimit() and getAccordionAllDataByLimit() functions in ReadMoreData.php. The user-supplied $_GET['orderby'] value is only processed through esc_attr() (an HTML-escaping function) before being passed to these data

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:41faa3139b0f443d9a5e1400c3db008e7ff59f13b35c3fbbeb5fad1307ef4bde

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"Read More & Accordion","vendor":"edmonparker","versions":[{"lessThanOrEqual":"3.5.7","status":"affected","version":"0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:9aa0755639afe148fd5130d5ed988865c077e2831ec62963eb00efc5fb84796c · sha256:a155e62e1f053779… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:9aa0755639afe148fd5130d5ed988865c077e2831ec62963eb00efc5fb84796c · sha256:a155e62e1f053779… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:9aa0755639afe148fd5130d5ed988865c077e2831ec62963eb00efc5fb84796c · sha256:a155e62e1f053779… · /containers/cna/problemTypes/0/descriptions/0

Source references

9 source assertions

{"url":"https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/classes/ReadMoreData.php#L1522"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9aa0755639afe148fd5130d5ed988865c077e2831ec62963eb00efc5fb84796c · sha256:a155e62e1f053779… · /containers/cna/references/2

{"url":"https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/classes/ReadMoreData.php#L1537"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9aa0755639afe148fd5130d5ed988865c077e2831ec62963eb00efc5fb84796c · sha256:a155e62e1f053779… · /containers/cna/references/6

{"url":"https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/views/accordionBuilder/list.php#L29"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9aa0755639afe148fd5130d5ed988865c077e2831ec62963eb00efc5fb84796c · sha256:a155e62e1f053779… · /containers/cna/references/8

{"url":"https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/views/readMorePagesView.php#L29"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9aa0755639afe148fd5130d5ed988865c077e2831ec62963eb00efc5fb84796c · sha256:a155e62e1f053779… · /containers/cna/references/4

{"url":"https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMoreData.php#L1522"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9aa0755639afe148fd5130d5ed988865c077e2831ec62963eb00efc5fb84796c · sha256:a155e62e1f053779… · /containers/cna/references/1

{"url":"https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMoreData.php#L1537"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9aa0755639afe148fd5130d5ed988865c077e2831ec62963eb00efc5fb84796c · sha256:a155e62e1f053779… · /containers/cna/references/5

{"url":"https://plugins.trac.wordpress.org/browser/expand-maker/trunk/views/accordionBuilder/list.php#L29"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9aa0755639afe148fd5130d5ed988865c077e2831ec62963eb00efc5fb84796c · sha256:a155e62e1f053779… · /containers/cna/references/7

{"url":"https://plugins.trac.wordpress.org/browser/expand-maker/trunk/views/readMorePagesView.php#L29"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9aa0755639afe148fd5130d5ed988865c077e2831ec62963eb00efc5fb84796c · sha256:a155e62e1f053779… · /containers/cna/references/3

{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc7c7e21-fbd7-4451-bc7d-3d11db01a443?source=cve"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9aa0755639afe148fd5130d5ed988865c077e2831ec62963eb00efc5fb84796c · sha256:a155e62e1f053779… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer