CVE-2026-9172: Devs Accounting WordPress Plugin Unauthenticated Data Deletion Vulnerability

Technical summary

CVE-2026-9172 exploits a missing permission_callback on the REST route 'devs-accounting/v1/delete-account/(?P<id>\d+)' in the Devs Accounting plugin. The delete_single_account() function processes DELETE or GET requests without verifying user authentication or capabilities. WordPress defaults to allowing unauthenticated access when no permission_callback is specified. Attackers can soft-delete rows in the wp_dac_accounts table by issuing requests with arbitrary numeric account IDs. The vulnerability is classified as CWE-862 (Missing Authorization).

Business impact

Organizations relying on the Devs Accounting plugin risk data loss or corruption of critical financial records. Attackers could systematically delete customer accounts, invoice records, or transaction data, disrupting accounting workflows and creating compliance or audit trail problems. The ability to target specific account IDs means targeted attacks against particular clients or projects are feasible. Soft-deletion may allow recovery depending on backup practices, but the vulnerability enables malicious modification of financial records without detection unless logging is enabled.

Affected systems

The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is affected in version 1.2.0 and all earlier versions. Any WordPress site with this plugin installed and activated is at risk. The vulnerability is unauthenticated and requires only network access to the WordPress site; no special network position or user privileges are needed to exploit it.

Exploitability

Exploitability is very high. The attack requires no authentication, no user interaction, and minimal technical sophistication. An attacker needs only to know or guess an account ID and send a single HTTP request. The CVSS 3.1 score of 5.3 (MEDIUM) reflects the integrity impact (unauthorized data deletion) balanced against the lack of confidentiality or availability impact in the vector itself, though business availability may be indirectly affected. The attack vector is network-based with low complexity and no privileges required.

Remediation

Upgrade to a patched version of the Devs Accounting plugin as soon as it becomes available from the vendor. Until a patch is released, disable or deactivate the plugin to eliminate the attack surface. If continued use is critical, consider implementing additional access controls at the web server or WAF level to restrict REST API endpoints to authenticated users, though this is a temporary mitigation and does not address the root cause.

Patch guidance

Monitor the plugin vendor's repository and security advisories for a patch version above 1.2.0. Verify patch availability before upgrading to confirm the fix addresses the missing permission_callback on the delete-account endpoint. Test the patched version in a staging environment to ensure no accounting workflows are disrupted. After patching, review audit logs for any unauthorized deletion attempts and verify account records against backups.

Detection guidance

Monitor HTTP access logs for requests to the REST endpoint 'wp-json/devs-accounting/v1/delete-account/' from non-administrative users or unauthenticated sessions. Look for GET or DELETE requests with numeric ID parameters. Enable WordPress security logging and REST API audit logging if available. Check the wp_dac_accounts table for unexpected soft-deletes (records with deletion timestamps or is_deleted flags set to true) that do not correlate with legitimate administrative actions. Correlate access logs with backup restore points to identify the time window of any unauthorized deletions.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), this vulnerability warrants high prioritization due to its direct impact on financial data integrity and the trivial effort required to exploit it. Unauthenticated, network-accessible REST endpoints that modify or delete data pose significant risk to data governance, audit compliance, and business continuity. Organizations using this plugin should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a MEDIUM severity rating based on the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The score accounts for network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and an integrity impact (I:L) from unauthorized data deletion. The scope is unchanged (S:U) and there is no confidentiality or availability impact in the base vector. However, in practice, loss of accounting records can affect business availability and continuity, making this riskier than the numeric score alone suggests.

Frequently asked questions