PT-2026-51691 · Ajitdas · Devs Accounting – Simple Accounting/Invoicing Solution

Jamaal · Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-9175

Mitre

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.0. This is due to the get single account() REST API callback being registered with a permission callback that unconditionally returns true, providing no authentication or authorization checks on the /devs-accounting/v1/get-account/ endpoint. This makes it possible for unauthenticated attackers to read arbitrary private financial account records (including account name, bank name, and opening balance) by enumerating the numeric account ID, resulting in sensitive information disclosure.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-9175

Affected Products

Devs Accounting – Simple Accounting/Invoicing Solution

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-9175 · Security Note
• https://plugins.trac.wordpress.org/browser/devs-accounting/tags/1.2.0/classes/class-devs-accounting-accounts.php#L31 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2212585b-1437-40a8-a5da-5b5c9f88c365?source=cve · Note
• https://plugins.trac.wordpress.org/browser/devs-accounting/tags/1.2.0/classes/class-devs-accounting-accounts.php#L157 · Note