Description
The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not have administrator privileges) to delete arbitrary files on the server, such as wp-config.php, which takes the entire site offline.
Published: 2026-11-06
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 07:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-22

Fri, 06 Nov 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not have administrator privileges) to delete arbitrary files on the server, such as wp-config.php, which takes the entire site offline.
Title Ever Accounting < 2.3.3 - Accounting Manager+ Arbitrary File Deletion via CSV Import
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-11-06T06:00:25.610Z

Reserved: 2026-10-27T15:09:54.870Z

Link: CVE-2026-118045

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-06T06:16:40.593

Modified: 2026-11-06T06:16:40.593

Link: CVE-2026-118045

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T07:30:09Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')