CVE-2024-13639 identifies a missing authorization vulnerability in the Read More & Accordion plugin for WordPress, specifically in the expmDeleteData() function. This flaw permits authenticated users with low privileges (Subscriber or above) to delete arbitrary 'read more' posts due to the absence of a capability check. The vulnerability affects all versions up to and including 3.4.2. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low privileges required, no user interaction, and an impact limited to integrity loss.

An attacker with Subscriber-level access or higher can delete arbitrary 'read more' posts, leading to unauthorized modification and potential loss of data integrity within the affected WordPress plugin. There is no impact on confidentiality or availability reported. This could disrupt content presentation or management but does not compromise sensitive information or system uptime.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals and monitor for unauthorized content deletions. Avoid granting Subscriber or higher privileges to untrusted users. Follow updates from the edmonparker vendor for patch availability.