CVE-2026-118045: Ever Accounting < 2.3.3 - Accounting Manager+ Arbitrary File Deletion via CSV Import

Q: Who can exploit this issue?

A user with the plugin's custom Accounting Manager role can exploit it. That role does not require WordPress administrator privileges.

Q: What access does an attacker need?

The attacker needs an authenticated account assigned the Accounting Manager role and access to the plugin's CSV import routine. The issue is not described as exploitable by unauthenticated visitors.

Q: What is the likely impact?

An attacker can delete arbitrary server files by supplying an unrestricted file path to the CSV import routine. Deleting wp-config.php can take the entire WordPress site offline.

Q: Which versions are affected?

Ever Accounting versions earlier than 2.3.3 are affected.

Published Nov 6, 2026

Updated

The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not have administrator privileges) to delete arbitrary files on the server, such as wp-config.php, which takes the entire site offline.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ever Accounting to a version that resolves this vulnerability.
Fixed in 2.3.3

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with the plugin's custom Accounting Manager role can exploit it. That role does not require WordPress administrator privileges.

What access does an attacker need?

The attacker needs an authenticated account assigned the Accounting Manager role and access to the plugin's CSV import routine. The issue is not described as exploitable by unauthenticated visitors.

What is the likely impact?

An attacker can delete arbitrary server files by supplying an unrestricted file path to the CSV import routine. Deleting wp-config.php can take the entire WordPress site offline.

Which versions are affected?

Ever Accounting versions earlier than 2.3.3 are affected.

CVE-2026-118045: Ever Accounting < 2.3.3 - Accounting Manager+ Arbitrary File Deletion via CSV Import

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

What is the likely impact?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

What is the likely impact?

Which versions are affected?