Unauthorized Data Modification in Devs Accounting Plugin for WordPress

CVE-2026-9172

What is CVE-2026-9172?

The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress has a vulnerability that allows unauthorized users to modify or delete accounting records. This issue arises from a missing capability check in the delete_single_account() function. The absence of a permission callback for the REST route 'devs-accounting/v1/delete-account/(?P\d+)' exposes it to public, unauthenticated access. As a result, attackers can issue straightforward GET requests to this endpoint with any account ID, enabling them to soft-delete arbitrary accounting records stored in wp_dac_accounts.

References