CVE-2026-118045
Ever Accounting < 2.3.3 - Accounting Manager+ Arbitrary File Deletion via CSV Import
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not have administrator privileges) to delete arbitrary files on the server, such as wp-config.php, which takes the entire site offline.
| Vendor | unknown |
| Product | ever accounting |
| Published | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown ever accounting
Be the first to know when new unknown vulnerabilities affecting unknown ever accounting are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Ever Accounting
0 < 2.3.3
References
Credits
Haemanth VJ WPScan