What is the CVSS score of CVE-2026-65499?

CVE-2026-65499 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

PeproDev Ultimate Invoice CVE-2026-65499

EUVD-2026-48110 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-7q74-2jpq-hj7v

WordPress Authentication Bypass Peprodev Ultimate Invoice Wordpress Plugin Pepro Dev Group

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable with no authentication (PR:N) per CWE-862 missing authorization; limited confidentiality and integrity impact on invoice data only, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:18 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.

AnalysisAI

Unauthenticated broken access control in PeproDev Ultimate Invoice WordPress plugin versions 2.2.6 and below allows remote attackers to bypass authorization checks without any credentials, resulting in limited confidentiality and integrity impact against invoice data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation requiring no authentication or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity lowers the barrier for opportunistic exploitation.

Technical ContextAI

PeproDev Ultimate Invoice is a WordPress plugin providing invoicing functionality, identified via CPE cpe:2.3:a:pepro_dev._group:peprodev_ultimate_invoice:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization), meaning one or more plugin endpoints or AJAX actions fail to perform WordPress capability checks (e.g., current_user_can()) before processing requests. In the WordPress plugin ecosystem, this class of flaw typically manifests when REST API routes or admin-ajax handlers are registered without nonce validation or role-gating, allowing unauthenticated HTTP requests to reach privileged functionality. The affected scope includes invoice creation, retrieval, or modification operations that should require at minimum subscriber-level access.

RemediationAI

No vendor-released patched version is independently confirmed from the available data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/pepro-ultimate-invoice/vulnerability/wordpress-peprodev-ultimate-invoice-plugin-2-2-6-broken-access-control-vulnerability for the latest patch status and upgrade guidance. If a newer version is available via the WordPress plugin repository, update immediately. As a compensating control where patching is not immediately possible, restrict access to the WordPress admin-ajax endpoint and any REST API routes exposed by the plugin using a web application firewall rule or server-level IP allowlisting - note this may break legitimate invoice functionality for remote users. Alternatively, temporarily deactivating the plugin eliminates the attack surface at the cost of invoicing functionality. Site administrators should also audit access logs for unusual unauthenticated requests to plugin-specific endpoints.