The Read More & Accordion plugin for WordPress permits a time‑based blind SQL injection through the orderby GET parameter. The value is processed only with esc_attr() and is escaped with esc_sql() but inserted directly, without surrounding quotes, into an ORDER BY clause before the query is prepared. This flaw allows an attacker to inject arbitrary SQL expressions such as (SELECT SLEEP(5)), enabling them to probe database contents covertly. An authenticated user with administrator or higher privileges—or any role with plugin‑admin access via yrm-user-roles—can exploit the flaw to extract sensitive data, including administrator password hashes.

The vulnerability affects all releases of the Read More & Accordion WordPress plugin from edmonparker that are version 3.5.7 or older. Current users with these versions and administrator‑level access should be notified.

The CVSS score of 4.9 indicates moderate severity; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires authenticated access at the administrator level, so its exploitation window is limited to sites where such permissions exist. A successful exploit can lead to data exfiltration, credential theft, and potential further compromise if attackers pivot within the database.