PT-2026-51691 · Ajitdas · Devs Accounting – Simple Accounting/Invoicing Solution

Jamaal · Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-9175

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.0. This is due to the get single account() REST API callback being registered with a permission callback that unconditionally returns true, providing no authentication or authorization checks on the /devs-accounting/v1/get-account/ endpoint. This makes it possible for unauthenticated attackers to read arbitrary private financial account records (including account name, bank name, and opening balance) by enumerating the numeric account ID, resulting in sensitive information disclosure.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-9175

Produtos afetados

Devs Accounting – Simple Accounting/Invoicing Solution

Referências · 3

• https://plugins.trac.wordpress.org/browser/devs-accounting/tags/1.2.0/classes/class-devs-accounting-accounts.php#L31 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/2212585b-1437-40a8-a5da-5b5c9f88c365?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/devs-accounting/tags/1.2.0/classes/class-devs-accounting-accounts.php#L157 · Nota