CVE-2026-65499
MediumCVSS 6.5Summary
The PeproDev Ultimate Invoice plugin versions 2.2.6 and earlier have an unauthenticated broken access control vulnerability. Unauthenticated users can gain unauthorized access to functions or data.
Risk Assessment
The risk includes the possibility of unauthorized access to sensitive functions or data, potentially leading to information leakage or content manipulation.
Recommendation
It is recommended to update the PeproDev Ultimate Invoice plugin to a version newer than 2.2.6 that fixes this vulnerability.
Other vulnerabilities in PeproDev Ultimate Invoice
See all- CVE-2026-65516High
The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. An attacker can trick the server into sending requests to internal resources.
- CVE-2026-65510High
The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code.
- CVE-2026-27372Medium
The PeproDev Ultimate Invoice plugin for WordPress versions 2.2.6 and earlier contains an unauthenticated sensitive data exposure vulnerability.
- CVE-2024-32518Medium
The PeproDev Ultimate Invoice WordPress plugin (by Pepro Dev. Group) up to version 2.0.0 has a missing authorization vulnerability that could allow unauthorized users to perform certain operations.
Original NVD description (English source)
Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.