What is the CVSS score of CVE-2026-65516?

CVE-2026-65516 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of PeproDev Ultimate Invoice are affected by CVE-2026-65516?

The PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) exposes organizations to attacks on internal networks and cloud infrastructure through an unauthenticated vulnerability.

How to fix or mitigate CVE-2026-65516?

Within 24 hours: audit all WordPress installations for the PeproDev Ultimate Invoice plugin and document affected versions; immediately deploy firewall or WAF rules to block the WordPress application from making outbound requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254). Within 7 days: disable or remove the vulnerable plugin on all affected systems; if operationally critical, migrate to an alternative invoice solution or restrict plugin access to authenticated users only. Within 30 days: subscribe to PeproDev security advisories; when a patch is released, test the update in a non-production environment and deploy to production with the firewall controls maintained as defense-in-depth.

PeproDev Ultimate Invoice CVE-2026-65516

EUVD-2026-48120 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-23 Patchstack

GHSA-4966-5qv6-xgv5

WordPress SSRF Peprodev Ultimate Invoice Wordpress Plugin Pepro Dev Group

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Unauthenticated network SSRF with low complexity (AV:N/AC:L/PR:N/UI:N); scope changes as forged requests reach other systems (S:C) with limited confidentiality/integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:28 vuln.today

CVE Published

Jul 23, 2026 - 11:19 cve.org

HIGH 7.2

DescriptionCVE.org

Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.

AnalysisAI

Server-Side Request Forgery in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) lets unauthenticated remote attackers coerce the WordPress server into issuing HTTP requests to attacker-chosen destinations. Because the CVSS vector marks a scope change (S:C), the forged requests can reach systems beyond the vulnerable plugin - notably internal network hosts and cloud metadata endpoints - with only low confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature keeps it a meaningful patch priority for exposed WordPress sites.

Technical ContextAI

The affected component is a commercial WordPress invoicing plugin (CPE cpe:2.3:a:pepro_dev._group:peprodev_ultimate_invoice) that runs inside the PHP/WordPress request-handling stack. The root cause is CWE-918 (Server-Side Request Forgery): a plugin endpoint accepts a user-supplied URL or host value and performs a server-side fetch (typically via PHP's wp_remote_get/cURL/file_get_wrappers) without validating or allow-listing the destination. Invoice plugins commonly fetch remote logos, currency/exchange-rate data, PDF/asset resources, or payment-gateway callbacks, and any such fetch driven by unsanitized input is the classic SSRF sink. The CVSS scope-changed flag indicates the impact crosses the security authority of the web server into other reachable network resources.

RemediationAI

No vendor-released patch version is identified in the available data; the '<= 2.2.6 affected' phrasing implies a fixed release should exist, so administrators should upgrade PeproDev Ultimate Invoice to the newest available version above 2.2.6 as soon as the vendor publishes it and monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/pepro-ultimate-invoice/vulnerability/wordpress-peprodev-ultimate-invoice-plugin-2-2-6-server-side-request-forgery-ssrf-vulnerability) for the confirmed fixed version. Until a patch is applied, apply compensating controls: place a WAF/virtual patch (Patchstack or equivalent) in front of the site to block the vulnerable request pattern; restrict the plugin's outbound network egress so the PHP worker cannot reach internal RFC1918 ranges or the cloud metadata IP 169.254.169.254 (trade-off: may break legitimate remote logo/exchange-rate fetches the plugin performs); and if the plugin is not essential, deactivate and remove it. As a WordPress-hardening measure, define WP_HTTP_BLOCK_EXTERNAL and set WP_ACCESSIBLE_HOSTS to an allow-list of required endpoints to constrain server-side HTTP requests (side effect: any plugin needing other external hosts will fail until allow-listed).