What is the CVSS score of EUVD-2026-48153?

EUVD-2026-48153 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Ultimate Invoice EUVD-2026-48153

| CVE-2026-27372 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-07-23 Patchstack

GHSA-q265-wj3h-mqcc

WordPress Information Disclosure Peprodev Ultimate Invoice Wordpress Plugin Pepro Dev Group

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible with no auth required; UI:R reflects attacker dependence on victim interaction; C:H covers full invoice data disclosure with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:02 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.

AnalysisAI

Sensitive data exposure in PeproDev Ultimate Invoice (WordPress plugin, versions ≤ 2.2.6) allows unauthenticated remote attackers to access confidential invoice data - including likely customer PII and financial records - without authentication, contingent on some user interaction (CVSS UI:R). The root cause (CWE-201) is the inclusion of sensitive information in plugin-generated output or endpoint responses that lack proper access control. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

PeproDev Ultimate Invoice is a WordPress plugin (CPE: cpe:2.3:a:pepro_dev._group:peprodev_ultimate_invoice:*:*:*:*:*:*:*:*) used to generate and manage invoices within WordPress environments. CWE-201 (Insertion of Sensitive Information Into Sent Data) describes a root cause where the application inadvertently embeds sensitive data - such as customer names, addresses, payment terms, or financial figures - in HTTP responses, document URLs, or API output that are accessible without authentication. For invoice plugins this typically manifests as predictable or publicly accessible invoice preview/download endpoints that return full document contents without verifying the requester's identity or authorization to view the document.

RemediationAI

Update the PeproDev Ultimate Invoice plugin to the version released after 2.2.6 via the WordPress plugin dashboard or the plugin vendor's distribution channel; a fixed version beyond 2.2.6 is implied by the advisory scope but an exact patched release number was not provided in available data - verify the current available version via the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/pepro-ultimate-invoice/vulnerability/wordpress-peprodev-ultimate-invoice-plugin-2-2-6-sensitive-data-exposure-vulnerability before updating. If an update is not immediately available, consider temporarily deactivating the plugin to prevent data exposure, accepting the trade-off of losing invoicing functionality. Additionally, implement web application firewall rules to block unauthenticated access to invoice preview or download endpoints, and audit web server logs for unusual unauthenticated access patterns to invoice-related URLs.