CVE-2026-9172

Name of the Vulnerable Software and Affected Versions Devs Accounting – Simple Accounting and Invoicing Solution versions prior to 1.2.1

Description A missing capability check in the delete single account() function allows unauthorized modification or deletion of data. The REST route '/devs-accounting/v1/delete-account/(?Pd+)' is registered without a permission callback, exposing the endpoint to public, unauthenticated access. This enables unauthenticated attackers to soft-delete arbitrary accounting account records within wp dac accounts by sending a GET request to the endpoint using the id variable.

Recommendations Update the plugin to a version later than 1.2.0. As a temporary workaround, restrict public access to the '/devs-accounting/v1/delete-account/(?Pd+)' endpoint.