PT-2026-110070 · WordPress · Wp-Invoice
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
WP-Invoice versions prior to 4.3.2
Description
Several AJAX handlers in the plugin fail to perform capability checks. This allows any authenticated user, including those with Subscriber level permissions, to retrieve personally identifiable information (PII) of all registered users, specifically their email addresses, display names, and profile details.
Recommendations
Update WP-Invoice to version 4.3.2 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wp-Invoice