What is the CVSS score of EUVD-2026-42567?

EUVD-2026-42567 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Easy Invoice EUVD-2026-42567

| CVE-2026-9021 MEDIUM

Missing Authorization (CWE-862)

2026-07-09 Wordfence

GHSA-q2rr-fm39-2rpw

WordPress Authentication Bypass Wordpress Plugin Easy Invoice Invoice Generator Pdf Quotes Payments

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network AJAX endpoint requires no auth (nonce is public); integrity-only impact limited to quote state changes; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 12:01 vuln.today

CVE Published

Jul 09, 2026 - 09:31 nvd

MEDIUM 5.3

DescriptionCVE.org

The Easy Invoice plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.19. This is due to the plugin registering the easy_invoice_accept_quote and easy_invoice_decline_quote AJAX actions via wp_ajax_nopriv_ hooks and relying solely on a quote-scoped nonce that is rendered into the publicly accessible single quote template, combined with an ownership check that is gated behind an off-by-default Pro option (easy_invoice_pro_restrict_quote_to_client). This makes it possible for unauthenticated attackers to accept or decline arbitrary published quotes - and, depending on the configured accept action, automatically convert them into invoices (and even email them to the client) - by harvesting the per-quote nonce from the public quote page and submitting it to admin-ajax.

AnalysisAI

Unauthenticated remote manipulation of published business quotes is possible in the Easy Invoice WordPress plugin (versions up to and including 2.1.19) due to missing authorization on AJAX endpoints. The plugin registers quote acceptance and decline actions via wp_ajax_nopriv_ hooks - making them reachable without credentials - while the only gate is a per-quote nonce that is embedded directly in the publicly viewable single-quote template. The ownership restriction that would prevent non-owners from acting on quotes is controlled by an off-by-default Pro feature flag, meaning the overwhelming majority of free-tier deployments are fully exposed to arbitrary quote status manipulation, including automatic invoice generation and client email dispatch. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

WordPress's AJAX subsystem routes requests to wp-admin/admin-ajax.php and dispatches based on the 'action' parameter. Hooks registered with wp_ajax_nopriv_ are executed for unauthenticated visitors, in contrast to wp_ajax_ which requires a logged-in session. The Easy Invoice plugin (CPE: cpe:2.3:a:matrixaddons:easy_invoice_-_invoice_generator,_pdf_quotes_&_payments:*:*:*:*:*:*:*:*) registers easy_invoice_accept_quote and easy_invoice_decline_quote under wp_ajax_nopriv_ and protects them only with a WordPress nonce that is scoped per-quote - not per-user. This nonce is rendered into the public-facing single quote template (templates/quotes/single.php), visible to any visitor who loads the quote URL. The authorization check that would verify whether the acting party is the intended quote recipient exists in QuoteController.php but is conditionally executed only when the easy_invoice_pro_restrict_quote_to_client option is enabled - an off-by-default Pro-tier setting. CWE-862 (Missing Authorization) applies directly: the authorization logic exists in the codebase but is disabled by default, making the AJAX actions functionally unrestricted for standard deployments.

RemediationAI

Upgrade Easy Invoice to version 2.2.0 or later, which contains the corrected authorization logic in QuoteController.php as documented in the WordPress SVN changeset at https://plugins.trac.wordpress.org/changeset/3517910/easy-invoice/trunk/includes/Controllers/QuoteController.php. If immediate upgrade is not feasible, enable the easy_invoice_pro_restrict_quote_to_client option in the plugin's Pro settings to enforce ownership checks on quote AJAX actions - note this requires an active Pro license and will require quote recipients to be authenticated users, which may break workflows that rely on unauthenticated clients acting on publicly shared quote links. As an additional or interim layer, deploy WAF rules to block POST requests to wp-admin/admin-ajax.php where the action parameter matches easy_invoice_accept_quote or easy_invoice_decline_quote from IP ranges not associated with known clients; this trades operational convenience for attack surface reduction but does not fix the underlying flaw. Avoid configuring automatic invoice generation and client email dispatch on quote acceptance until the patch is applied, as this limits the downstream business impact of any exploitation.