Ever Accounting WordPress plugin CSV import allows arbitrary file deletion
WordPress accounting plugin users can delete server files, taking sites down.
Summary
A missing file-path restriction in the Ever Accounting WordPress plugin's CSV import lets users with the Accounting Manager role delete server files such as wp-config.php. Versions before 2.3.3 are affected, and deleting that file takes the whole site offline.
Affected when
- Users with the Accounting Manager role
- Ever Accounting before 2.3.3
What to do
Update Ever Accounting to 2.3.3 or later.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
Times
First published
First seen