CVE-2024-13639 MEDIUM

CVE-2024-13639: Read More & Accordion <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post Deletion

Vendor Edmonparker

Product Read More & Accordion

Weakness CWE-862 · Missing authorization

Published February 13, 2025

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the expmDeleteData() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary 'read more' posts.

Key dates

02Disclosure timeline

February 13, 2025 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-13639 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2022-4950 Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation CVE-2025-6043 Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2023-4468 Poly Trio 8500/Trio 8800/Trio C60 Poly Lens Management Cloud Registration authorization CVE-2025-44001 Unauthorized Channel Subscription Read in Mattermost Confluence Plugin CVE-2024-39546 Junos OS Evolved: Local low-privilege user can gain root permissions leading to privilege escalation