CVE-2026-9175

Name of the Vulnerable Software and Affected Versions Devs Accounting – Simple Accounting and Invoicing Solution versions prior to 1.2.1

Description The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress contains a missing authorization flaw. The get single account() function is registered with a permission callback that unconditionally returns true, which bypasses authentication and authorization checks on the '/devs-accounting/v1/get-account/' endpoint. This allows unauthenticated attackers to disclose sensitive private financial account records, such as account name, bank name, and opening balance, by enumerating the id variable.

Recommendations Update the plugin to a version later than 1.2.0. As a temporary workaround, restrict access to the '/devs-accounting/v1/get-account/' endpoint to minimize the risk of information disclosure.