CVE-2026-9857

Name of the Vulnerable Software and Affected Versions Invoice123 versions prior to 1.7.1

Description An authorization bypass exists because the software fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can exploit this to overwrite the API key stored in wp options, modify plugin settings, and alter WooCommerce tax rate data within the wp woocommerce tax rates table. This is achieved through the AJAX actions s123 submit api key() and s123 submit invoice settings().

Recommendations Update Invoice123 to a version later than 1.7.0. As a temporary mitigation, restrict access to the s123 submit api key() and s123 submit invoice settings() AJAX actions.