CVE-2026-9172

Description

The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to unauthorized modification/deletion of data due to a missing capability check on the delete_single_account() function in versions up to, and including, 1.2.0. The REST route 'devs-accounting/v1/delete-account/(?P<id>\d+)' is registered without any permission_callback, which causes WordPress to expose the endpoint to public, unauthenticated access. This makes it possible for unauthenticated attackers to soft-delete arbitrary accounting account records (wp_dac_accounts) by issuing a simple GET request to the endpoint with any account ID.

PUBLISHED Reserved 2026-05-21 | Published 2026-06-24 | Updated 2026-06-24 | Assigner Wordfence

Problem types

CWE-862 Missing Authorization

Product status

Timeline

Credits

jamaal finder

References

www.wordfence.com/...-ba74-4e97-8d14-659897942906?source=cve

plugins.trac.wordpress.org/...s-devs-accounting-accounts.php

plugins.trac.wordpress.org/...s-devs-accounting-accounts.php

cve.org (CVE-2026-9172)

nvd.nist.gov (CVE-2026-9172)

Download JSON