CVE-2026-118045 · Package
NO FIX YET · SEE WHAT TO DO
The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path given to its CSV import routine to an allowed directory. A user with the plugin's Accounting Manager role can delete arbitrary files on the server, such as wp-config.php, which takes the whole site offline.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Ever Accounting WordPress plugin before 2.3.3 that have users assigned the custom Accounting Manager role. Sites without the plugin, or without accounts holding that role, are not exposed through this flaw. The sources do not say whether the flaw is reachable by unauthenticated visitors.
Not affected if no-accounting-manager-users, plugin-version-2.3.3-or-later
Who cares ever-accounting, wordpress, wordpress-plugin
wp-content/plugins/.2.3.3 or later (the description says the flaw is fixed before 2.3.3).The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not have administrator privileges) to delete arbitrary files on the server, such as wp-config.php, which takes the entire site offline.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.