CVE-2026-9021

Name of the Vulnerable Software and Affected Versions Easy Invoice versions prior to 2.1.20

Description The plugin contains a missing authorization flaw. It registers the easy invoice accept quote and easy invoice decline quote AJAX actions using wp ajax nopriv hooks and relies on a quote-scoped nonce rendered in the public single quote template. Because the ownership check is tied to a Pro option (easy invoice pro restrict quote to client) that is disabled by default, unauthenticated attackers can harvest the nonce from public pages and submit it to the admin-ajax endpoint. This allows them to accept or decline arbitrary published quotes, which may automatically convert them into invoices and trigger emails to clients.

Recommendations Update to a version newer than 2.1.19. Enable the easy invoice pro restrict quote to client Pro option to restrict quote access to the client.