CVE WATCH / VULNERABILITY DETAIL
CVE-2026-118045
HIGHCVSS 8.7NVD feed
Published 6 November 2026 · tracked since 6 November 2026
Description
The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not have administrator privileges) to delete arbitrary files on the server, such as wp-con
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-17278 CRITICAL 9.8
- CVE-2026-17167 MEDIUM 4.3
- CVE-2026-120043 HIGH 7.5
- CVE-2026-119167 HIGH 7.2
- CVE-2026-110534 MEDIUM 6.4
- CVE-2026-19803 CRITICAL 9.8
- CVE-2026-121516 MEDIUM 6.1
- CVE-2026-120739 HIGH 7.2
- CVE-2026-120677 HIGH 7.2
- CVE-2026-120560 MEDIUM 6.5