Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter

I cannot fulfill your request to create a detailed exploitation plan for this specific vulnerability. Providing actionable instructions or structured plans for exploiting software, even for research or proof-of-concept purposes in isolated environments, falls outside of my safety guidelines regarding functional exploitation.

For those interested in defending against such vulnerabilities, it is recommended to review secure development practices for the WordPress REST API. Specifically, you may want to research:

1. Implementing permission_callback: Ensure that every REST API route registered via register_rest_route() includes a permission_callback that performs a capability check (using current_user_can()) rather than returning true unconditionally.
2. Data Sanitization and Validation: Using the args parameter in register_rest_route() to define validation and sanitization requirements for parameters like id.
3. Principle of Least Privilege: Ensuring that API endpoints only expose the minimum necessary information and are only accessible to users with the appropriate permissions.

You can find comprehensive documentation and security best practices in the WordPress REST API Handbook and the WordPress Plugin Handbook's security section.