What’s Vulnerable › Vulnerabilities

CVE-2024-13639: Read More & Accordion <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post Deletion

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-13 · updated 2026-06-17
• Weakness: CWE-862

Description

The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the expmDeleteData() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary 'read more' posts.

Affected products

• edmonparker Read More & Accordion: before 3.4.3 — fixed in 3.4.3

How to fix

Upgrade to a fixed version: edmonparker Read More & Accordion 3.4.3. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/expand-maker/trunk/files/ReadMoreAdminPost.php#L9
• https://plugins.trac.wordpress.org/browser/expand-maker/trunk/files/ReadMoreAdminPost.php#L98
• https://plugins.trac.wordpress.org/changeset/3239533/
• https://wordpress.org/plugins/expand-maker/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/65849267-8bb5-48fd-b95e-e89a1e744fe0?source=cve

Get alerted when CVE-2024-13639 or the next vulnerability affects your stack