Wp Invoice
Monthly
Information disclosure in the WP-Invoice WordPress plugin through version 4.3.1 allows any authenticated user - including a low-privileged Subscriber - to retrieve the email addresses, display names and profile details of every registered user on the site by invoking AJAX handlers that perform no capability checks. The issue is network-exploitable with low attack complexity (CVSS 3.1: 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and requires only a valid logged-in account, which an attacker can often self-provision when public user registration is enabled. Publicly available exploit code exists, but CISA's SSVC assessment records no known exploitation at time of analysis, and no KEV listing applies. Because the leaked roster of names and emails is directly reusable for phishing and credential-targeting, the practical risk is moderate for sites with open registration and low for closed-membership deployments.
Information disclosure in the WP-Invoice WordPress plugin through version 4.3.1 allows any authenticated user - including a low-privileged Subscriber - to retrieve the email addresses, display names and profile details of every registered user on the site by invoking AJAX handlers that perform no capability checks. The issue is network-exploitable with low attack complexity (CVSS 3.1: 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and requires only a valid logged-in account, which an attacker can often self-provision when public user registration is enabled. Publicly available exploit code exists, but CISA's SSVC assessment records no known exploitation at time of analysis, and no KEV listing applies. Because the leaked roster of names and emails is directly reusable for phishing and credential-targeting, the practical risk is moderate for sites with open registration and low for closed-membership deployments.