CVE-2026-9175: Devs Accounting Information Disclosure Bug

CVE-2026-9175 Overview

CVE-2026-9175 is a missing authorization vulnerability in the Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress. The flaw affects all versions up to and including 1.2.0. The plugin registers the get_single_account() REST API callback with a permission_callback that unconditionally returns true. As a result, the /devs-accounting/v1/get-account/<id> endpoint performs no authentication or authorization checks. Unauthenticated attackers can enumerate numeric account IDs to read arbitrary private financial account records, including account name, bank name, and opening balance. The issue is classified under [CWE-862: Missing Authorization].

Critical Impact
Unauthenticated remote attackers can read private financial account data, including bank names and opening balances, by enumerating numeric account IDs.

Affected Products

Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress
All versions up to and including 1.2.0
WordPress sites exposing the /devs-accounting/v1/get-account/<id> REST endpoint

Discovery Timeline

2026-06-24 - CVE-2026-9175 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-9175

Vulnerability Analysis

The vulnerability resides in the plugin's REST API registration logic. The plugin exposes a route at /devs-accounting/v1/get-account/<id> handled by the get_single_account() callback. WordPress requires every REST route to define a permission_callback that evaluates whether the requester is authorized to invoke the endpoint. In this plugin, the permission_callback returns true for every request, regardless of the caller's identity or capabilities.

Because the callback never inspects authentication state or user roles, the route accepts requests from any source on the public internet. The handler then loads the account record matching the numeric id path parameter and returns its full contents in the JSON response. Sensitive fields including account name, bank name, and opening balance are disclosed.

Account identifiers are sequential integers, so attackers can iterate from 1 upward to harvest every record stored by the plugin. The result is bulk disclosure of private financial information from any WordPress site running an affected version.

Root Cause

The root cause is an insecure REST API registration pattern. The developer used permission_callback => '__return_true' (or an equivalent function returning true) on a route that exposes private data. This pattern is intended for genuinely public endpoints and must not be used for resource read operations involving non-public records.

Attack Vector

The attack is performed over the network with no authentication, no privileges, and no user interaction. An attacker sends an HTTP GET request to https://<target>/wp-json/devs-accounting/v1/get-account/<id>, substituting <id> with sequential integers. Each successful response returns the underlying account record. Automated enumeration scripts can extract the entire account dataset within seconds.

No verified public exploit code is available. The vulnerable code paths can be reviewed in the plugin source on WordPress.org and the Wordfence vulnerability report.

Detection Methods for CVE-2026-9175

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/devs-accounting/v1/get-account/<id> paths in web server logs.
Sequential numeric enumeration patterns against the get-account endpoint from a single source IP.
HTTP 200 responses to the get-account route originating from sessions without WordPress authentication cookies.

Detection Strategies

Search WordPress and reverse proxy access logs for any request path containing devs-accounting/v1/get-account/.
Alert on user agents that issue more than a small number of requests to the get-account endpoint within a short interval.
Correlate REST API access with absence of wordpress_logged_in_* cookies to identify unauthenticated data retrieval.

Monitoring Recommendations

Enable verbose REST API logging and ship request and response metadata to a centralized SIEM for retention and analysis.
Baseline normal traffic to plugin REST routes and trigger alerts when request volume or ID range deviates from baseline.
Monitor outbound data flows from the WordPress host for unusual large JSON payloads that may indicate scraping.

How to Mitigate CVE-2026-9175

Immediate Actions Required

Update the Devs Accounting plugin to a version newer than 1.2.0 once the vendor publishes a fixed release.
Deactivate and remove the plugin from WordPress installations until a patched version is available if financial data confidentiality is required.
Review web server access logs for prior enumeration of the get-account endpoint and treat any harvested records as disclosed.

Patch Information

At the time of publication, no fixed version is listed in the Wordfence vulnerability report. Administrators should track the plugin's changelog on WordPress.org and apply the next release that addresses the missing permission_callback enforcement on /devs-accounting/v1/get-account/<id>.

Workarounds

Block requests to /wp-json/devs-accounting/v1/get-account/ at a web application firewall or reverse proxy until a patch is installed.
Restrict access to the WordPress REST API to authenticated sessions using a security plugin or custom rest_authentication_errors filter.
Place the affected WordPress instance behind IP allowlisting if the accounting functionality is only required by internal users.

bash

# Example nginx rule to block unauthenticated access to the vulnerable endpoint
location ~ ^/wp-json/devs-accounting/v1/get-account/ {
    return 403;
}