What is the CVSS score of CVE-2026-9175?

CVE-2026-9175 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Devs Accounting CVE-2026-9175

EUVD-2026-38659 MEDIUM

Missing Authorization (CWE-862)

2026-06-24 Wordfence

GHSA-xwwp-6j8w-c2pm

WordPress Authentication Bypass Information Disclosure Wordpress Plugin Devs Accounting Simple Accounting And Invoicing Solution

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

REST API is network-reachable with no authentication or complexity; impact is read-only partial confidentiality with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 06:59 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Devs Accounting - Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.0. This is due to the get_single_account() REST API callback being registered with a permission_callback that unconditionally returns true, providing no authentication or authorization checks on the /devs-accounting/v1/get-account/<id> endpoint. This makes it possible for unauthenticated attackers to read arbitrary private financial account records (including account name, bank name, and opening balance) by enumerating the numeric account ID, resulting in sensitive information disclosure.

AnalysisAI

Unauthenticated information disclosure in the Devs Accounting WordPress plugin (all versions through 1.2.0) exposes private financial account records to any internet-connected attacker. The REST API endpoint /devs-accounting/v1/get-account/<id> was registered with a permission_callback that unconditionally returns true, entirely bypassing WordPress authorization. By sequentially enumerating integer account IDs, an unauthenticated attacker can harvest account names, bank names, and opening balances for every financial account stored in the plugin. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the trivial attack complexity makes opportunistic automation highly likely.

Technical ContextAI

The affected component is a WordPress REST API route registered via the WordPress REST API framework. In WordPress, REST API endpoints must define a permission_callback function that enforces access control; CWE-862 (Missing Authorization) occurs when this callback is present but non-functional. The vulnerable code at class-devs-accounting-accounts.php line 31 registers the get_single_account() callback for the /devs-accounting/v1/get-account/<id> route, and at line 157 the permission_callback unconditionally returns true, meaning WordPress never gates access. The numeric <id> path parameter maps directly to sequential database record IDs, creating a classic insecure direct object reference (IDOR) pattern on top of the authorization bypass. The CPE cpe:2.3:a:ajitdas:devs_accounting_-_simple_accounting_and_invoicing_solution:*:*:*:*:*:*:*:* covers all versions up to and including 1.2.0.

RemediationAI

No vendor-released patched version is confirmed in the available input data; the highest tagged release in the WordPress plugin repository referenced is 1.2.0, which is vulnerable. Site administrators should monitor the plugin's WordPress.org listing for an updated release that corrects the permission_callback at class-devs-accounting-accounts.php line 31 to perform proper capability checks (e.g., current_user_can('manage_options')). As an immediate compensating control, deactivating or uninstalling the plugin eliminates the exposed endpoint entirely with no side effects beyond loss of plugin functionality. Alternatively, administrators can use a WAF rule or nginx/Apache rewrite to block external access to the /wp-json/devs-accounting/ namespace, though this may break legitimate plugin front-end operations. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2212585b-1437-40a8-a5da-5b5c9f88c365 should be monitored for patch availability updates.