CVE-2026-7472 describes a time-based blind SQL Injection vulnerability in the Read More & Accordion plugin for WordPress, affecting all versions up to 3.5.7. The issue arises from improper neutralization of special elements in the 'orderby' parameter, which is processed with esc_sql() but concatenated unquoted into an ORDER BY clause in SQL queries within getAllDataByLimit() and getAccordionAllDataByLimit() functions. Because esc_sql() only escapes quotes and backslashes, it does not prevent injection of arbitrary SQL expressions in an unquoted ORDER BY context. Exploitation requires authenticated access with administrator-level or equivalent permissions, allowing attackers to extract sensitive database information such as administrator credential hashes via time delays (e.g., SELECT SLEEP(5)).

An attacker with administrator-level or equivalent access can exploit this vulnerability to perform time-based blind SQL Injection attacks, enabling extraction of sensitive data from the database, including administrator credential hashes. The vulnerability does not affect availability or integrity directly but compromises confidentiality of sensitive information. The CVSS 3.1 base score is 4.9 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's admin pages to trusted administrators only and consider disabling or removing the plugin if possible. Avoid using the vulnerable versions in production environments. Monitor vendor channels for updates or patches addressing this vulnerability.