Peterpatter

**Name of the Vulnerable Software and Affected Versions** Easy Invoice versions prior to 2.1.20 **Description** The plugin contains a missing authorization flaw. It registers the `easy invoice accept quote` and `easy invoice decline quote` AJAX actions using `wp ajax nopriv ` hooks and relies on a quote-scoped nonce rendered in the public single quote template. Because the ownership check is tied to a Pro option (`easy invoice pro restrict quote to client`) that is disabled by default, unauthenticated attackers can harvest the nonce from public pages and submit it to the `admin-ajax` endpoint. This allows them to accept or decline arbitrary published quotes, which may automatically convert them into invoices and trigger emails to clients. **Recommendations** Update to a version newer than 2.1.19. Enable the `easy invoice pro restrict quote to client` Pro option to restrict quote access to the client.