What is the CVSS score of CVE-2026-2343?

CVE-2026-2343 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Peprodev Ultimate Invoice are affected by CVE-2026-2343?

Organizations using PeproDev Ultimate Invoice WordPress plugin through 2.2.5 should be aware of moderate risk from CVE-2026-2343 rated CVSS 5.3.

Is there a public PoC exploit available for CVE-2026-2343?

Yes, a public proof-of-concept exploit is available for CVE-2026-2343. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-2343?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Peprodev Ultimate Invoice CVE-2026-2343

EUVD-2026-15188 MEDIUM

2026-03-25 WPScan

GHSA-w7c9-8pqp-97mg

WordPress Information Disclosure Peprodev Ultimate Invoice Unknown

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

PoC Detected

Mar 25, 2026 - 15:41 vuln.today

Public exploit code

EUVD ID Assigned

Mar 25, 2026 - 06:15 euvd

EUVD-2026-15188

Analysis Generated

Mar 25, 2026 - 06:15 vuln.today

CVE Published

Mar 25, 2026 - 06:00 nvd

MEDIUM 5.3

DescriptionCVE.org

The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII.

AnalysisAI

The PeproDev Ultimate Invoice WordPress plugin through version 2.2.5 contains an information disclosure vulnerability in its bulk download invoices feature, which generates ZIP archives with predictably named files containing exported invoice PDFs. An unauthenticated or low-privileged attacker can brute force the predictable ZIP file naming scheme to retrieve and download archives containing sensitive personally identifiable information (PII) from invoices. A public proof-of-concept exploit is available via WPScan, making this vulnerability actively exploitable in the wild.

Technical ContextAI

The vulnerability stems from insecure file naming practices in the WordPress plugin's ZIP archive generation functionality. When users initiate a bulk download of invoices, the plugin creates ZIP files with predictable naming patterns rather than using cryptographically random or non-sequential identifiers. This falls under CWE-330 (Use of Insufficiently Random Values) and CWE-639 (Authorization Bypass Through User-Controlled Key). The affected product is identified via CPE as cpe:2.3:a:unknown:peprodev_ultimate_invoice:*:*:*:*:*:*:*:*, indicating the vulnerability affects all versions of the PeproDev Ultimate Invoice plugin up to and including version 2.2.5. The underlying issue is that the plugin does not implement secure temporary file handling or access controls to prevent enumeration of generated archives.

RemediationAI

Users must immediately upgrade the PeproDev Ultimate Invoice plugin to a version newer than 2.2.5 once a patched version is released by the vendor. Until an official patch is available, website administrators should consider disabling the bulk download invoices feature entirely or restricting access to trusted administrators only via WordPress role-based access controls. As a temporary mitigation, implement web application firewall rules to block repeated requests to the plugin's ZIP download endpoint, or place the WordPress installation behind a reverse proxy that enforces rate limiting and requires authentication before accessing invoice download functionality. Monitor access logs for suspicious patterns of file enumeration attempts targeting the plugin's temporary file directory. Consult WPScan's security advisory at https://wpscan.com/vulnerability/ac1572ca-7994-401d-a268-6a8773e60ab1/ for vendor patch availability and deployment guidance.