Executive brief
The Devs Accounting plugin for WordPress, which manages business finances and invoicing, contains a security flaw that allows unauthorized access to financial records. An attacker can view sensitive information such as bank names, account names, and opening balances without needing to log in. This could lead to the exposure of private business financial data and potential reputational damage.
Technical details
The vulnerability is classified as Missing Authorization (CWE-862) within the get_single_account() REST API callback. The 'permission_callback' for the /devs-accounting/v1/get-account/<id> endpoint is configured to unconditionally return true, bypassing all authentication and authorization checks. An unauthenticated attacker can exploit this by sending a network request to the endpoint and enumerating numeric account IDs. Successful exploitation results in the disclosure of sensitive financial data, including account names, bank names, and opening balances.
Affected products
- ajitdas Devs Accounting – Simple Accounting and Invoicing Solution up to, and including, 1.2.0
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://plugins.trac.wordpress.org/browser/devs-accounting/tags/1.2.0/classes/class-devs-accounting-accounts.php
- https://plugins.trac.wordpress.org/browser/devs-accounting/tags/1.2.0/classes/class-devs-accounting-accounts.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2212585b-1437-40a8-a5da-5b5c9f88c365?source=cve