CVE-2026-9175: Devs Accounting WordPress Plugin Missing Authorization – MEDIUM Severity

Technical summary

The get_single_account() REST API endpoint in Devs Accounting is registered with a permission_callback that unconditionally returns true, effectively bypassing authentication and authorization. The vulnerable endpoint /devs-accounting/v1/get-account/<id> accepts numeric account IDs and returns account records containing sensitive fields (account name, bank name, opening balance) without verifying the requester's identity or rights. An unauthenticated attacker can enumerate account IDs to exfiltrate private financial records. This is a classic authorization bypass (CWE-862) resulting in confidentiality loss.

Business impact

Organizations using this plugin to manage client or internal financial accounts face exposure of sensitive banking and account information. Even though the vulnerability does not permit modification or deletion of records, the disclosure of account names, associated banks, and opening balances can enable fraud, social engineering, or competitive intelligence gathering. If the plugin is used to track customer accounts, the exposure constitutes a data breach that may trigger regulatory notification obligations (GDPR, state privacy laws, PCI-DSS if payment data is involved). Incident response, customer notification, and potential regulatory fines represent material financial and reputational risk.

Affected systems

WordPress installations running the Devs Accounting – Simple Accounting and Invoicing Solution plugin in versions 1.2.0 and earlier are vulnerable. The scope is limited to WordPress sites that have this specific plugin installed and activated; there is no impact to WordPress core, other plugins, or non-WordPress systems. Any WordPress site publicly accessible on the internet and running a vulnerable version is at risk if the /devs-accounting/v1/ REST endpoint is reachable.

Exploitability

Exploitability is straightforward. No authentication, user interaction, or complex setup is required—an attacker simply crafts HTTP GET requests to /devs-accounting/v1/get-account/<id> with sequential or guessed numeric IDs from the public internet. No CVSS complexity factors apply. The vulnerability is neither listed on CISA's Known Exploited Vulnerabilities catalog nor reported as actively weaponized in the wild as of the publication date, but the ease of exploitation means it is likely to be targeted opportunistically. Any script-based reconnaissance or automated enumeration tool can discover and extract records in bulk.

Remediation

Update the Devs Accounting plugin to a patched version released after version 1.2.0. Verify the patch version against the plugin vendor's official advisory or repository. In the interim, if patching is delayed, consider disabling REST API access to the Devs Accounting endpoints via .htaccess, nginx configuration, or a firewall rule to block /devs-accounting/v1/* paths. Alternatively, restrict access to the plugin's REST endpoints using a Web Application Firewall (WAF) rule that requires authentication tokens or IP whitelisting for financial data endpoints.

Patch guidance

Obtain an updated version of the Devs Accounting plugin from the official WordPress plugin repository or vendor website, ensuring it is released after June 25, 2026 (the vulnerability modification date). Apply the update through the WordPress plugin dashboard or via direct installation. Verify that the updated version no longer exposes the /devs-accounting/v1/get-account/<id> endpoint without authentication. Test the endpoint after patching to confirm access is denied for unauthenticated requests. Document the patch version applied and the date of remediation for compliance and audit purposes.

Detection guidance

Monitor web server logs for repeated requests to /devs-accounting/v1/get-account/ with varying numeric IDs from the same source IP or user agent. A pattern of sequential or rapid ID enumeration is a strong indicator of exploitation attempts. Enable WordPress plugin update notifications and audit logs if available. Check the plugin version via the WordPress admin interface (Plugins > Installed Plugins) and compare against the vendor's security advisory to determine if the site is running a vulnerable version. For proactive detection, configure a WAF or IDS rule to alert on requests to /devs-accounting/v1/get-account/ from unauthenticated users or IP ranges outside your trusted network.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), this vulnerability should be prioritized for rapid remediation because: (1) it requires no authentication or interaction to exploit, (2) it directly discloses sensitive financial data that may trigger regulatory notification, (3) WordPress plugin vulnerabilities are routinely scanned and exploited at scale, and (4) the fix is a straightforward plugin update with minimal operational friction. Organizations handling customer or sensitive financial data should treat this as HIGH priority despite the numeric score.

Risk score, explained

CVSS 5.3 (MEDIUM) reflects a vulnerability with network accessibility and low attack complexity, but limited impact (confidentiality only, no integrity or availability loss). However, this numeric score does not capture the business risk: financial data disclosure has downstream compliance and fraud implications that elevate practical risk. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) correctly identifies the authorization bypass and lack of access controls, but organizations should apply business context (data sensitivity, regulatory environment) to override the score if needed.

Frequently asked questions