File Path Vulnerability in Ever Accounting Plugin for WordPress
CVE-2026-118045
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 6 November 2026
Badges
What is CVE-2026-118045?
The Ever Accounting plugin for WordPress prior to version 2.3.3 is susceptible to an improper input validation vulnerability in its CSV import routine. This flaw allows users with the custom Accounting Manager role, which lacks administrative privileges, to specify unrestricted file paths. Consequently, this could lead to unauthorized file deletions on the server, including critical files like wp-config.php, potentially resulting in a complete site outage. It highlights the importance of proper input validation to mitigate security risks.
Affected Version(s)
Ever Accounting 0 < 2.3.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.