EUVD-2026-42859
GHSA-q7j5-p4m6-7h8q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Subscriber-level authentication required (PR:L); network-reachable handlers with no complexity; integrity-only impact on plugin settings and tax data, no confidentiality or availability effect.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Invoice123 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the plugin's API key stored in wp_options, modify invoice plugin settings, and alter WooCommerce tax rate data in the wp_woocommerce_tax_rates table.
AnalysisAI
Authorization bypass in the Invoice123 WordPress plugin (versions up to and including 1.7.0) permits authenticated attackers holding only subscriber-level accounts to overwrite the plugin's external API key, modify invoice configuration settings, and directly alter WooCommerce tax rate records in the database. The root cause is absent capability checks in the plugin's admin-page handlers, meaning low-privilege users can invoke privileged administrative actions over the network. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin registers WordPress admin-page or AJAX action handlers without calling current_user_can() or an equivalent capability check before executing privileged logic. The vulnerable code is confirmed present in two files across both the 1.6.8 and 1.7.0 tagged releases in the WordPress plugin repository (slug: saskaita123-lt): S123_ApiKey.php at lines 21 and 29 (governing API key storage in wp_options) and S123_InvoiceSettings.php at lines 18, 26, and 65 (governing invoice plugin configuration and WooCommerce tax rate writes to the wp_woocommerce_tax_rates table). The CVSS vector AV:N/AC:L/PR:L/UI:N confirms the handlers are reachable over the network with no interaction from a higher-privileged user, and that exploitation complexity is low once a subscriber-level session is established. No CPE identifiers were provided in the intelligence.
RemediationAI
The primary remediation is to update the Invoice123 plugin beyond version 1.7.0; the upstream fix commit is visible at the WordPress plugin Trac changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3594935%40saskaita123-lt&new=3594935%40saskaita123-lt), but the exact patched release version is not confirmed - verify the current version on the WordPress.org plugin page before advising an upgrade target. The Wordfence threat intelligence entry (https://www.wordfence.com/threat-intel/vulnerabilities/id/7d4e685a-0462-447f-a639-4f95d5aa27ab) should be monitored for updated patch version confirmation. As a compensating control while patching, disable open user registration on the WordPress site (Settings > General, uncheck 'Anyone can register') to prevent anonymous users from obtaining the subscriber accounts needed to exploit this flaw - note this affects legitimate sign-up workflows. Additionally, audit the wp_options table for unexpected changes to the Invoice123 API key and review the wp_woocommerce_tax_rates table for unauthorized tax rate modifications as indicators of prior exploitation.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today