CVE-2026-7467 Details.
Read More & Accordion <= 3.5.7 - Authenticated Privilege Escalation
Atlas does not check this one. Needs requests that change data.
To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check.
About CVE-2026-7467. What It Means.
The Read More & Accordion (expand-maker) plugin for WordPress through 3.5.7 allows privilege escalation due to improper validation in the importData AJAX handler (yrm_import_data action). An authenticated user with plugin access can upload a crafted JSON attachment to insert arbitrary rows into WordPress database tables, including those that control user roles and capabilities, potentially leading to site takeover.
Affected Product. What Is Hit.
- Vendor
- radmore
- Product
- Radmore Expand Maker
FAQ
Common Questions.
Read More & Accordion <= 3.5.7 - Authenticated Privilege Escalation. The Read More & Accordion (expand-maker) plugin for WordPress through 3.5.7 allows privilege escalation due to improper validation in the importData AJAX handler (yrm_import_data action). An authenticated user with plugin access can upload a crafted JSON attachment to insert arbitrary rows into WordPress database tables, including those that control user roles and capabilities, potentially leading to site takeover.
No. To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check. The facts about CVE-2026-7467 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-7467 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update Radmore Expand Maker to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-7467. Atlas does not run a check for it, so nothing here says whether a particular site is affected.