The Devs Accounting plugin for WordPress suffers from a missing authorization flaw (CWE-862). The get_single_account() REST API callback is registered with a permission_callback that always returns true, meaning the /devs-accounting/v1/get-account/<id> endpoint can be accessed without authentication. An unauthenticated attacker can request any numeric account ID and retrieve private financial data, such as account name, bank name, and opening balance, leading to sensitive information disclosure.

All installations of the Devs Accounting – Simple Accounting and Invoicing Solution plugin version 1.2.0 or earlier on WordPress sites are vulnerable. The flaw exists regardless of user role or network placement when the plugin is activated.

With a CVSS score of 5.3 the vulnerability is classified as moderate. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but exposure is possible to any actor who can reach the site’s REST API. Exploitation requires only a simple HTTP GET request to the endpoint and enumeration of sequential numeric IDs, making the attack straightforward for anyone with network access to the host.