Ever Accounting Plugin Arbitrary File Deletion via Path Traversal

CVE-2026-118045 is a critical path traversal vulnerability in the Ever Accounting WordPress plugin that allows users with the Accounting Manager role to delete arbitrary files from the server. By manipulating file paths in the CSV import routine without proper validation, attackers can target sensitive files like wp-config.php, causing complete site outages. This vulnerability is particularly dangerous because it requires no administrator privileges—any user granted the custom Accounting Manager role becomes a vector for destructive attacks. Organizations running Ever Accounting versions before 2.3.3 face immediate risk of data loss and business continuity disruption, especially in multi-user WordPress environments where role-based access control is assumed to provide adequate protection.

While this CVE does not directly map to MITRE ATT&CK techniques, Casky's security practitioners would detect the attack patterns through reconnaissance of file system manipulation and privilege abuse behaviors. The underlying attack chain involves CWE-73 (External Control of File Name or Path), which practitioners should monitor through log analysis for suspicious file operations, unusual CSV import requests with path traversal payloads (../ sequences), and deletion attempts on critical WordPress configuration files. Although Casky currently has 0 matching skills indexed for this specific vulnerability, security teams using Claude AI with extended reasoning can build detection logic by analyzing: (1) CSV import requests containing path traversal patterns, (2) file deletion events initiated by non-administrator accounts, and (3) unusual access patterns to wp-config.php and other sensitive files. Practitioners should prioritize immediate patching to version 2.3.3+ and implement strict input validation controls on all file import operations.