CVE-2026-9172

The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to unauthorized modification/deletion of data due to a missing capability check on the delete_single_account() function in versions up to, and including, 1.2.0. The REST route 'devs-accounting/v1/delete-account/(?P<id>\d+)' is registered without any permission_callback, which causes WordPress to expose the endpoint to public, unauthenticated access. This makes it possible for unauthenticated attackers to soft-delete arbitrary accounting account records (wp_dac_accounts) by issuing a simple GET request to the endpoint with any account ID.

• CWE-862

• https://plugins.trac.wordpress.org/browser/devs-accounting/tags/1.2.0/classes/class-devs-accounting-accounts.php#L199
• https://plugins.trac.wordpress.org/browser/devs-accounting/tags/1.2.0/classes/class-devs-accounting-accounts.php#L36
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe99411-ba74-4e97-8d14-659897942906?source=cve

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9158In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially …9.8
• CVE-2026-9162Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5…4.3
• CVE-2026-9165A flaw was found in Red Hat Advanced Cluster Security for Ku…7.7
• CVE-2026-9169DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.…8.8
• CVE-2026-9170IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of serv…9.8
• CVE-2026-9171IBM WebSphere Application Server and WebSphere Application S…7.5
• CVE-2026-9175The Devs Accounting – Simple Accounting and Invoicing Soluti…5.3
• CVE-2026-9177A Server-Side Template Injection (SSTI) vulnerability was id…9.4
• CVE-2026-9178The WP Forms Connector plugin for WordPress is vulnerable to…7.5
• CVE-2026-9179The WP Forms Connector plugin for WordPress is vulnerable to…7.5
• CVE-2026-9180The MotoPress Appointment Booking plugin for WordPress is vu…5.3
• CVE-2026-9181Esri ArcGIS Server contains a directory traversal vulnerabil…7.5