Read More & Accordion (WordPress plugin): privilege escalation (CVE-2026-7467), no fixed version confirmed
Published 28/10/2026 19:15 · Updated 28/10/2026 19:18 (revision 2)
Timeline
3 events over 1 d 18 h
- 27/10/2026CorroboratedVulnCheck KEV+1 d 17 h
- 28/10/2026 18:13ConfirmedWordPress security releases+1 h
- 28/10/2026 19:15Published on WatchtowerPro CISO
In short
The Read More & Accordion WordPress plugin (slug expand-maker) up to and including 3.5.7 lets authenticated users with plugin role access insert rows into the wp_users and wp_usermeta tables and create an administrator account. A Nuclei detection template exists. No fixed version is confirmed. WordPress 7.1.4, a separate core security release published on 28/10/2026, does not fix this plugin flaw.
How bad is it
High. An attacker who has a login with plugin access, such as an editor or author account, can create their own administrator account and take over the WordPress site.
Being exploited.
Severity score
CVSS 3.1 from NVD, from wordfence.com, read 28/10/2026.
What an attacker needs
- Internet access to itEnough
- A loginA user account
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Take it offline
Type: privilege escalation.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Read More & Accordion plugin (expand-maker), all versions up to and including 3.5.7.
- Only users the site owner has granted access through the plugin's role settings can exploit it; it is not an unauthenticated flaw.
What to do now
- Find every WordPress site that runs Read More & Accordion (slug expand-maker) and check the installed version; versions up to and including 3.5.7 are affected.
- No fixed plugin version is confirmed yet. Check the plugin's changelog for a release above 3.5.7 and update once the vendor states it fixes this issue.
- Until then, deactivate and remove the plugin where it is not needed.
- If the plugin must stay, open its role settings and remove access for every role except trusted administrators, and disable open registration. These interim measures reduce exposure but do not make the site safe.
- Check for administrator accounts you do not recognise and for recent changes to the wp_users and wp_usermeta tables; reset passwords and sessions for privileged users.
- Separately, update WordPress core to 7.1.4 (security release, 28/10/2026); this is a different issue and does not fix the plugin flaw.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer, all 3 sources with their dates and every revision. And technology matching: which of your systems run WordPress, at which version, fixed or not - and what each one needs.
Main sources
WordPress 7.1.4 Vendor · Known exploited (VulnCheck KEV): edmonparker Read More & Accordion - edmonsoft read_more_\&_accordion Improper Privilege Management Research · CVE-2026-7467 Detail - NVD Research
Data: Shodan - WordPress (estimate, 28/10/2026) · GreyNoise - CVE-2026-7467 (estimate, 28/10/2026)