Description

The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not have administrator privileges) to delete arbitrary files on the server, such as wp-config.php, which takes the entire site offline.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-11-06T06:16:40.593Z",
  "pubdate": "2026-11-06T06:16:40.593Z",
  "executiveSummary": "The Ever Accounting WordPress plugin, in versions prior to 2.3.3, contains a critical vulnerability characterized by improper input validation within its CSV import routine. This security flaw allows an authenticated attacker possessing the 'Accounting Manager' role to perform arbitrary file deletion on the underlying server filesystem. The vulnerability stems from the application's failure to restrict user-supplied file paths to a secure, designated directory, enabling directory traversal attacks. Successful exploitation permits the deletion of sensitive system files, including 'wp-config.php', which effectively results in a complete site outage and potential disruption of service. While this vulnerability requires authentication, the privilege level required is lower than that of a standard administrator, expanding the attack surface to any user assigned the specific 'Accounting Manager' capability. The risk is classified as critical due to the potential for total loss of service and the ability to compromise core application configurations.",
  "technicalDetails": "The vulnerability resides within the CSV import functionality of the Ever Accounting plugin. The root cause is an insufficient validation of the file path parameter handled by the plugin's import logic. During the CSV import process, the application does not implement adequate path sanitization or restriction to a specific upload directory, allowing for the inclusion of traversal sequences such as '../'.\nThe exploitation flow begins with an attacker authenticating to the WordPress instance using an account assigned the 'Accounting Manager' role. By intercepting or crafting a request directed at the CSV import routine, an attacker can manipulate the file path parameter to target sensitive files outside of the plugin's intended scope. By supplying a path like '../../wp-config.php', the application's internal file handling functions interpret this as an instruction to process or delete the targeted file. Because the web server process typically runs with the permissions of the web user, the application is capable of executing filesystem deletion operations on any file readable and writable by that user.\nThis behavior constitutes an Unrestricted Arbitrary File Deletion vulnerability. Upon execution of the malicious request, the file specified by the attacker is removed from the server. The impact is significant: deleting 'wp-config.php' forces the WordPress installation to initiate a new setup process, effectively locking administrators out of the site and rendering the application inaccessible to users, thereby achieving a successful Denial of Service (DoS) attack. Furthermore, the ability to delete arbitrary files could be leveraged by an attacker to remove security plugins, configuration files, or other critical site components, providing a gateway for further exploitation or persistence management. The vulnerability remains present in all versions prior to 2.3.3, and the exposure is limited only by the necessity of the 'Accounting Manager' role, which is a non-administrative account provided by the plugin."
}