Devs Accounting Simple Accounting And Invoicing Solution
Monthly
Unauthorized modification and deletion of accounting records in the Devs Accounting WordPress plugin allows unauthenticated attackers to soft-delete arbitrary entries via a missing permission callback in the delete_single_account() function. Versions up to and including 1.2.0 expose the REST route /devs-accounting/v1/delete-account/(?P<id>\d+) without authentication, enabling simple GET requests to delete records. The risk is tempered by low EPSS (0.23%) and no known active exploitation, but exploitation is trivially automatable.
Unauthenticated information disclosure in the Devs Accounting WordPress plugin (all versions through 1.2.0) exposes private financial account records to any internet-connected attacker. The REST API endpoint /devs-accounting/v1/get-account/<id> was registered with a permission_callback that unconditionally returns true, entirely bypassing WordPress authorization. By sequentially enumerating integer account IDs, an unauthenticated attacker can harvest account names, bank names, and opening balances for every financial account stored in the plugin. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the trivial attack complexity makes opportunistic automation highly likely.
Unauthorized modification and deletion of accounting records in the Devs Accounting WordPress plugin allows unauthenticated attackers to soft-delete arbitrary entries via a missing permission callback in the delete_single_account() function. Versions up to and including 1.2.0 expose the REST route /devs-accounting/v1/delete-account/(?P<id>\d+) without authentication, enabling simple GET requests to delete records. The risk is tempered by low EPSS (0.23%) and no known active exploitation, but exploitation is trivially automatable.
Unauthenticated information disclosure in the Devs Accounting WordPress plugin (all versions through 1.2.0) exposes private financial account records to any internet-connected attacker. The REST API endpoint /devs-accounting/v1/get-account/<id> was registered with a permission_callback that unconditionally returns true, entirely bypassing WordPress authorization. By sequentially enumerating integer account IDs, an unauthenticated attacker can harvest account names, bank names, and opening balances for every financial account stored in the plugin. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the trivial attack complexity makes opportunistic automation highly likely.