CVE-2026-9172: WordPress Devs Accounting Auth Bypass Flaw

CVE-2026-9172 Overview

CVE-2026-9172 is a missing authorization vulnerability [CWE-862] in the Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress. The flaw affects all versions up to and including 1.2.0. The plugin registers the REST route devs-accounting/v1/delete-account/(?P<id>\d+) without a permission_callback, exposing the endpoint to public, unauthenticated access. Unauthenticated attackers can issue a simple GET request to soft-delete arbitrary accounting account records stored in the wp_dac_accounts table. The issue results in unauthorized modification and deletion of business accounting data.

Critical Impact
Unauthenticated attackers can remotely soft-delete arbitrary accounting account records over the network by calling an unprotected REST endpoint.

Affected Products

Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress
All versions up to and including 1.2.0
WordPress sites exposing the devs-accounting/v1/delete-account REST route

Discovery Timeline

2026-06-24 - CVE-2026-9172 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-9172

Vulnerability Analysis

The vulnerability resides in the delete_single_account() function in class-devs-accounting-accounts.php. The plugin registers a REST API route to handle account deletion but omits the permission_callback argument in the register_rest_route() call. WordPress treats a missing permission_callback as a publicly accessible endpoint and emits a _doing_it_wrong notice rather than blocking the request.

Because no capability check or nonce validation is enforced before invoking the deletion logic, any client on the network can reach the handler. The handler accepts an integer account ID from the URL path and performs a soft delete against the wp_dac_accounts table. The vulnerability impacts data integrity without exposing data confidentiality or breaking availability of the underlying WordPress site.

Root Cause

The root cause is a missing authorization check [CWE-862]. The register_rest_route() invocation for devs-accounting/v1/delete-account/(?P<id>\d+) does not declare a permission_callback, so the route bypasses both authentication and capability enforcement. The deletion handler does not independently verify that the caller holds an administrative capability such as manage_options or edit_posts.

Attack Vector

An unauthenticated remote attacker sends a GET request to the vulnerable REST endpoint with any numeric account ID. No credentials, session, or user interaction are required. Successful exploitation marks the targeted accounting record as deleted, corrupting financial records used by site administrators. Attackers can iterate across IDs to soft-delete every account record in the database. See the Wordfence Vulnerability Analysis and the WordPress Plugin Code Reference for the unprotected route registration.

Detection Methods for CVE-2026-9172

Indicators of Compromise

Unauthenticated GET requests to /wp-json/devs-accounting/v1/delete-account/<id> in web server access logs.
Sequential or scripted requests iterating numeric account IDs against the REST endpoint.
Unexpected soft-deleted rows in the wp_dac_accounts table where no administrator initiated the action.

Detection Strategies

Alert on any HTTP request matching the path pattern devs-accounting/v1/delete-account/ originating from non-administrative IP ranges.
Correlate REST API request volume with authenticated WordPress sessions to identify unauthenticated abuse.
Review WordPress debug logs for _doing_it_wrong notices referencing missing permission_callback on this route.

Monitoring Recommendations

Forward WordPress access logs and PHP error logs to a centralized log analytics platform for query and alerting.
Monitor row-count deltas and soft-delete flags on the wp_dac_accounts table on a recurring schedule.
Track outbound enumeration patterns against wp-json endpoints from a single source IP.

How to Mitigate CVE-2026-9172

Immediate Actions Required

Disable or remove the Devs Accounting plugin until a patched version is available and verified.
Restrict access to the /wp-json/devs-accounting/ REST namespace at the web application firewall (WAF) or reverse proxy.
Audit the wp_dac_accounts table for unauthorized soft-deletions and restore from backup where required.

Patch Information

No fixed version has been published in the enriched data at the time of this writing. Site operators should monitor the Wordfence advisory and the plugin's repository for an updated release beyond 1.2.0 and apply it as soon as it becomes available.

Workarounds

Block requests matching the URI pattern wp-json/devs-accounting/v1/delete-account/ at the WAF, CDN, or .htaccess layer.
Deactivate the plugin in the WordPress admin until an upstream fix lands.
Restrict access to the /wp-json/ REST API to authenticated administrative users via a hardening plugin or custom rest_authentication_errors filter.

bash

# Example nginx rule to block the vulnerable REST route
location ~* /wp-json/devs-accounting/v1/delete-account/ {
    return 403;
}