CVE-2026-9175 describes a missing authorization vulnerability (CWE-862) in the Devs Accounting – Simple Accounting and Invoicing Solution WordPress plugin. The vulnerability exists because the get_single_account() REST API callback is registered with a permission_callback that always returns true, effectively disabling any access control on the /devs-accounting/v1/get-account/<id> endpoint. As a result, unauthenticated attackers can retrieve private financial account records by guessing numeric account IDs. This affects all versions up to and including 1.2.0. No official patch or remediation guidance is currently provided by the vendor.

An attacker without any authentication can access sensitive private financial information including account names, bank names, and opening balances by querying the vulnerable REST API endpoint. This results in information disclosure but does not affect integrity or availability. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, no user interaction, and impact limited to confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable REST API endpoint by implementing custom access controls or disabling the plugin if feasible. Monitor for updates from the vendor or security community regarding patches or official mitigations.