The Read More & Accordion plugin contains a missing nonce check in the addNewButtons() function, allowing attackers to forge requests that lead to local file inclusion of arbitrary PHP files. This flaw can be exploited by any site visitor to trick an authenticated administrator into clicking a specially crafted link, which then executes the included file with the admin’s privileges. The result is full remote code execution on the affected WordPress site, compromising confidentiality, integrity, and availability.

Affected systems are installations of the edmonparker Read More & Accordion WordPress plugin version 3.4.7 or earlier. The vulnerability applies to all WordPress sites running any of those versions of the plugin, as the CSRF mitigation is absent across the entire codebase up through 3.4.7.

The CVSS v3.1 base score of 7.5 indicates moderate‑to‑high severity. The EPSS score of less than 1% shows that the overall exploitation probability is low, and the vulnerability is not currently listed in CISA's KEV catalog. Nevertheless, the attack surface is a standard web request, meaning that an attacker can launch the exploit from anywhere without additional access. The primary attack vector is forged HTTP requests to the administrative endpoint, and the current exploitation complexity is low due to no prerequisite conditions beyond the CSRF flaw.