CVE-2024-32518
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The PeproDev Ultimate Invoice WordPress plugin (by Pepro Dev. Group) up to version 2.0.0 has a missing authorization vulnerability that could allow unauthorized users to perform certain operations.
Risk Assessment
An attacker without authorization could exploit the vulnerability to make unauthorized changes to plugin settings or access invoice data, potentially leading to confidentiality and integrity breaches.
Recommendation
Update the PeproDev Ultimate Invoice plugin to the latest version that includes the fix. Check for any unauthorized changes.
Other vulnerabilities in PeproDev Ultimate Invoice
See all- CVE-2026-65516High
The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. An attacker can trick the server into sending requests to internal resources.
- CVE-2026-65510High
The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code.
- CVE-2026-65499Medium
The PeproDev Ultimate Invoice plugin versions 2.2.6 and earlier have an unauthenticated broken access control vulnerability. Unauthenticated users can gain unauthorized access to functions or data.
- CVE-2026-27372Medium
The PeproDev Ultimate Invoice plugin for WordPress versions 2.2.6 and earlier contains an unauthenticated sensitive data exposure vulnerability.
Original NVD description (English source)
Missing Authorization vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice.This issue affects PeproDev Ultimate Invoice: from n/a through 2.0.0.