Hesabfa Accounting
Hesabfa Accounting has 4 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; 2 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 5.0, and the most serious one scores 6.1 out of 10. 2025 was the busiest year with 4 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 2 of the records (50%). Other recurring categories include Cross-Site Scripting, Insertion Of Sensitive Information Into Log File.
2 of the records (50%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, most of them (3) reported by Nabil Irawan. Hesabfa Accounting is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-48361Hesabfa Accounting <= 2.2.4 - Unauthenticated Sensitive Information Exposure via Log File
Read the full analysisVulnerability Records
Hesabfa Accounting
Author
Saeed Sattar Beglou
This plugin helps connect your (online) store to Hesabfa online accounting software. By using this plugin, saving products, contacts, and orders in your store will also save them automatically in your Hesabfa account. Besides that, just after a client pays a bill, the receipt document will be stored in Hesabfa as well. Of course, you have to register your account in Hesabfa first. To do so, visit Hesabfa at the link here www.hesabfa.com and sign up for free. After you signed up and entered your account, choose your business, then in the settings menu/API, you can find the API keys for the business and import them to the plugin settings. Now your module is ready to use. For more information and a full guide to how to use Hesabfa and WooCommerce Plugin, visit Hesabfa’s website and go to the “Accounting School” menu.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C