CVE-2026-9175
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.2.0. This is due to the get_single_account() REST API callback being registered with a permission_callback that unconditionally returns true, resulting in no authentication or authorization checks on the /devs-accounting/v1/get-account/<id> endpoint.
Risk Assessment
Unauthenticated attackers can access private financial account records, leading to the disclosure of sensitive information such as account name, bank name, and opening balance.
Recommendation
It is recommended to update the plugin to the latest version to address the authorization vulnerability and implement appropriate access controls for the API.
Original NVD description (English source)
The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.0. This is due to the get_single_account() REST API callback being registered with a permission_callback that unconditionally returns true, providing no authentication or authorization checks on the /devs-accounting/v1/get-account/<id> endpoint. This makes it possible for unauthenticated attackers to read arbitrary private financial account records (including account name, bank name, and opening balance) by enumerating the numeric account ID, resulting in sensitive information disclosure.