Title: plugin de WordPress Read More & Accordion, Description: El plugin Read More & Accordion para WordPress es vulnerable a inyección SQL ciega basada en tiempo a través del parámetro 'orderby' en todas las versiones hasta la 3.5.7, inclusive. Esto se debe al uso de esc_sql() sin rodear el valor entre comillas en una cláusula ORDER BY dentro de las funciones getAllDataByLimit() y getAccordionAllDataByLimit() en ReadMoreData.php. El valor parámetro 'orderby' proporcionado por el usuario solo se procesa a través de esc_attr() (una función de escape de HTML) antes de ser pasado a estas funciones de base de datos, donde se aplica esc_sql() pero el valor se concatena directamente -sin comillas- en el fragmento ORDER BY de la consulta SQL antes de que se llame a $wpdb -> prepare(). Debido a que esc_sql() solo escapa caracteres de comillas y barras invertidas (que son irrelevantes en un contexto ORDER BY sin comillas), un atacante puede inyectar expresiones SQL arbitrarias como ([SQL_SLEEP_STATEMENT]) o subconsultas condicionales para realizar una extracción de datos ciega basada en tiempo. Esto hace posible que atacantes autenticados con acceso de nivel de administrador o superior (o cualquier rol al que se le haya permitido explícitamente el acceso a las páginas de administración del plugin a través de la configuración yrm-user-roles) extraigan datos sensibles de la base de datos, incluyendo hashes de credenciales de administrador.

{"timestamp":"2026-05-20T17:16:22.722056Z","id":"CVE-2026-7472","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"edmonparker","product":"Read More & Accordion","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.5.7","versionType":"semver","status":"affected"}]}]

The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.5.7. This is due to the use of esc_sql() without surrounding the value in quotes in an ORDER BY clause inside the getAllDataByLimit() and getAccordionAllDataByLimit() functions in ReadMoreData.php. The user-supplied $_GET['orderby'] value is only processed through esc_attr() (an HTML-escaping function) before being passed to these database functions, where esc_sql() is applied but the value is directly concatenated—unquoted—into the ORDER BY fragment of the SQL query before $wpdb->prepare() is called. Because esc_sql() only escapes quote characters and backslashes (which are irrelevant in an unquoted ORDER BY context), an attacker can inject arbitrary SQL expressions such as (SELECT SLEEP(5)) or conditional subqueries to perform time-based blind data extraction. This makes it possible for authenticated attackers with administrator-level access or above (or any role explicitly permitted access to the plugin's admin pages via the yrm-user-roles setting) to extract sensitive data from the database, including administrator credential hashes.

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE-89

https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/classes/ReadMoreData.php#L1522

https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/classes/ReadMoreData.php#L1537

https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/views/accordionBuilder/list.php#L29

https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/views/readMorePagesView.php#L29

https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMoreData.php#L1522

https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMoreData.php#L1537

https://plugins.trac.wordpress.org/browser/expand-maker/trunk/views/accordionBuilder/list.php#L29

https://plugins.trac.wordpress.org/browser/expand-maker/trunk/views/readMorePagesView.php#L29

https://www.wordfence.com/threat-intel/vulnerabilities/id/cc7c7e21-fbd7-4451-bc7d-3d11db01a443?source=cve