CVE-2026-27372
MediumCVSS 6.5Summary
The PeproDev Ultimate Invoice plugin for WordPress versions 2.2.6 and earlier contains an unauthenticated sensitive data exposure vulnerability.
Risk Assessment
An unauthenticated person can access confidential information such as customer data or invoices, potentially leading to privacy breaches and financial loss.
Recommendation
Update the PeproDev Ultimate Invoice plugin to the latest available version.
Other vulnerabilities in PeproDev Ultimate Invoice
See all- CVE-2026-65516High
The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. An attacker can trick the server into sending requests to internal resources.
- CVE-2026-65510High
The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code.
- CVE-2026-65499Medium
The PeproDev Ultimate Invoice plugin versions 2.2.6 and earlier have an unauthenticated broken access control vulnerability. Unauthenticated users can gain unauthorized access to functions or data.
- CVE-2024-32518Medium
The PeproDev Ultimate Invoice WordPress plugin (by Pepro Dev. Group) up to version 2.0.0 has a missing authorization vulnerability that could allow unauthorized users to perform certain operations.
Original NVD description (English source)
Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.