WP-Invoice EUVD-2026-96796

Exploitation requires an authenticated WordPress account at any privilege level, including a low-tier Subscriber, on a site running WP-Invoice ≤4.3.1 - matching CVSS PR:L. The specific precondition is that the vulnerable AJAX handlers in the plugin perform no capability (permission) checks, so any logged-in session can invoke them regardless of role. The practical limiting factor is the need for a valid account: sites that disable public/open user registration substantially reduce exposure, since an attacker must otherwise obtain credentials. No user interaction, special configuration toggle, or non-default deployment mode is needed beyond having the plugin installed and active and possessing (or being able to create) any authenticated account.

This is a genuinely low-to-moderate priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a remotely reachable flaw with low attack complexity and no user interaction, but it requires an authenticated account (PR:L) and yields only limited confidentiality impact with no integrity or availability impact - consistent with an information-disclosure (CWE-200) bug. CISA's SSVC framing reinforces the modest risk: Exploitation=none (no observed in-the-wild activity), Automatable=no, and Technical Impact=partial. The flaw is NOT in CISA KEV, so there is no confirmed active exploitation; however, publicly available exploit code exists (reported by WPScan), which raises the practical likelihood of opportunistic abuse above a theoretical bug. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are internally consistent rather than conflicting: a low-privilege authenticated attacker can harvest PII, but there is no escalation or system compromise. Net: a real but bounded data-leakage issue - worth patching promptly on affected sites, not an emergency.

An attacker registers or already holds a low-privilege WordPress account (e.g., a Subscriber on a site that allows open registration) and sends crafted AJAX requests to WP-Invoice's unprotected handlers. Because capability checks are missing, the server returns email addresses, display names, and profile details for all registered users, enabling bulk PII harvesting for phishing or credential-stuffing target lists. Public exploit code exists (WPScan), lowering the skill barrier, though the low CVSS complexity means no sophisticated technique is required once authenticated.