The Ever Accounting WordPress plugin versions prior to 2.3.3 allow the CSV import functionality to specify a file path that is not constrained to a safe directory. As a result, a user who has been assigned the custom Accounting Manager role—which does not possess full administrative rights—can delete any file on the server that the web server can write to. This can include critical site files such as wp-config.php, which would bring the entire WordPress site offline, causing a loss of service and potential data loss. The vulnerability is a classic example of improper input validation leading to serious integrity and availability impact for the host.

All installations of the Ever Accounting WordPress plugin with a version less than 2.3.3 that still use the Accounting Manager role are affected. The vulnerability applies to any site that has not updated the plugin to the patched release.

The CVSS score is not provided in the available data, and the EPSS score is unavailable, so the exact technical severity cannot be quantified by those metrics. However, the vulnerability grants full file deletion privileges to non‑administrator users, which is a high‑enough risk to warrant immediate mitigation. The likely attack path is through the plugin’s administrative interface, where a user with the Accounting Manager role can choose to import a CSV file and manipulate the path field to point to arbitrary files on the server. Given the critical nature of files that can be deleted, the potential impact is severe even if the exploitability is moderate.