Unauthorized Data Deletion in Read More & Accordion Plugin for WordPress

CVE-2024-13639

Summary

The Read More & Accordion plugin for WordPress is susceptible to unauthorized modification and potential data loss. The vulnerability arises due to a missing capability check in the expmDeleteData() function, enabling authenticated users, even those with Subscriber-level access, to delete arbitrary 'read more' posts. This issue affects all versions of the plugin up to and including 3.4.2, highlighting the importance of implementing proper access controls to prevent unauthorized actions.

References