CVE-2026-48836
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
There is an unauthenticated remote code execution (RCE) vulnerability in Easy Invoice versions <= 2.1.19.
Risk Assessment
An attacker can remotely execute arbitrary code on the server, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to upgrade to the latest version of Easy Invoice to mitigate this vulnerability.
Other vulnerabilities in Easy Invoice
See all- CVE-2026-66676Medium
Unauthenticated Broken Access Control vulnerability in Easy Invoice plugin up to version 2.3.8. Unauthenticated users can access invoice and management functions that should be protected.
- CVE-2026-9021Medium
The Easy Invoice plugin for WordPress up to version 2.1.19 is vulnerable to Missing Authorization. It registers the easy_invoice_accept_quote and easy_invoice_decline_quote AJAX actions via wp_ajax_nopriv_ hooks, relying solely on a quote-scoped nonce rendered in the publicly accessible single quote template, combined with an off-by-default Pro option (easy_invoice_pro_restrict_quote_to_client). This allows unauthenticated attackers to accept or decline arbitrary published quotes and, depending on the configured accept action, automatically convert them into invoices (even emailing them to the client) by harvesting the per-quote nonce from the public quote page and submitting it to admin-ajax.
Original NVD description (English source)
Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS