Read the docs
TI-2023-03172 Aliases CVE-2023-3392GHSA-m8hv-934h-rrx4

Read More & Accordion < 3.2.7 - Admin+ PHP Object Injection

Priority HIGH 67Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The Read More & Accordion WordPress plugin before 3.2.7 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00998 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Read More & Accordion (Unknown): 3.2.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownRead More & Accordionbefore 3.2.73.2.7Patch availableCNA
  • Read More & Accordion VendorUnknown Affected before 3.2.7 Fixed in 3.2.7 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:edmonsoft:read_more_\&_accordion:*:*:*:*:*:wordpress:*:*before 3.2.7VulnerableAdam Skaat
  • cpe:2.3:a:edmonsoft:read_more_\&_accordion:*:*:*:*:*:wordpress:*:* Versions before 3.2.7 Vulnerable ·Adam Skaat

Remediation

  • Fix · CNA Read More & Accordion (Unknown) Fixed in 3.2.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-3392
  2. 2026-10-03 Alias added: GHSA-m8hv-934h-rrx4

References

Exploit 1

  • TI-2024-12678 Missing authorization in edmonparker Read More & Accordion CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences