WordPress Read More & Accordion Plugin Unauthorized Post Deletion Vulnerability

A vulnerability exists in the Read More & Accordion plugin for WordPress, specifically in versions through 3.4.2. The issue arises from a lack of proper capability checks in the expmDeleteData() function, allowing authenticated users with Subscriber-level access and above to delete arbitrary 'read more' posts. This flaw can lead to unauthorized data modification and loss.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of 'read more' posts, potentially leading to data loss and disruption of content management.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can send a request to the WordPress admin-post.php endpoint. The request must include the action 'delete_readmore' and the 'readMoreId' parameter specifying the ID of the 'read more' post to be deleted. Notably, the request must also include a valid nonce for the 'delete_read_more' action to bypass the missing authorization check.

Remediation

Users are advised to update the Read More & Accordion plugin to version 3.4.3 or later.