CVE-2026-7467 is a privilege escalation vulnerability in the Read More & Accordion WordPress plugin (versions up to 3.5.7). The vulnerability arises from improper privilege management (CWE-269) in the 'RadMoreAjax::importData' function, which fails to restrict which database tables can be written during import and does not validate imported data. This flaw enables authenticated attackers, with permissions assigned via the plugin's role settings, to insert arbitrary data into critical WordPress user tables ('wp_users' and 'wp_usermeta'), including the 'wp_capabilities' field. Consequently, attackers can create new administrator accounts and gain full administrative control over the affected WordPress site.

Successful exploitation allows an attacker with limited permissions granted by the plugin to escalate privileges to administrator level by creating new admin accounts. This compromises the confidentiality, integrity, and availability of the WordPress site, as attackers gain full control over user accounts and site management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict plugin permissions to trusted users only and consider disabling or removing the Read More & Accordion plugin if possible to prevent exploitation.