Missing Authorization in Devs Accounting WordPress Plugin

Compliance Impact

This vulnerability allows unauthenticated attackers to access private financial account records, including sensitive information such as account name, bank name, and opening balance. Such unauthorized disclosure of sensitive financial data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and financial information to protect user privacy and data security.

Specifically, the lack of authorization checks on the REST API endpoint means that confidential financial data can be exposed without consent, violating principles of data minimization and confidentiality mandated by these standards.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in the Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress, specifically in all versions up to and including 1.2.0. It is caused by the get_single_account() REST API callback being registered with a permission_callback that always returns true, meaning there are no authentication or authorization checks on the endpoint /devs-accounting/v1/get-account/<id>. As a result, unauthenticated attackers can access and read private financial account records by guessing or enumerating the numeric account ID.

• Unauthenticated attackers can retrieve sensitive information such as account name, bank name, and opening balance.
• The vulnerability leads to sensitive information disclosure without requiring any user authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by exposing sensitive financial information stored in the plugin to unauthorized parties. Attackers can access private account details such as account names, bank names, and opening balances without any authentication.

• Loss of confidentiality of private financial data.
• Potential privacy violations due to unauthorized data disclosure.
• Increased risk of fraud or identity theft if attackers misuse the exposed financial information.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the /devs-accounting/v1/get-account/<id> REST API endpoint is accessible without authentication or authorization.

One way to detect it is to attempt to enumerate numeric account IDs by sending HTTP GET requests to the endpoint and observing if private financial account data is returned without requiring credentials.

• Use curl commands to test access, for example: curl -X GET https://your-wordpress-site.com/wp-json/devs-accounting/v1/get-account/1
• Repeat the curl command with different numeric IDs to see if sensitive data is disclosed.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Devs Accounting – Simple Accounting and Invoicing Solution plugin to a version later than 1.2.0 where the vulnerability is fixed.

If an update is not immediately available, restrict access to the vulnerable REST API endpoint by implementing authentication or IP-based access controls on the /devs-accounting/v1/get-account/<id> endpoint.

Additionally, monitor your logs for any unauthorized access attempts to this endpoint and consider temporarily disabling the plugin if sensitive data exposure is a critical concern.

Useful 0 Not Useful 0