CVE-2026-65516
HighCVSS 7.2Summary
The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. An attacker can trick the server into sending requests to internal resources.
Risk Assessment
The risk includes the possibility of scanning the internal network, accessing internal services, or using the server to attack other systems.
Recommendation
It is recommended to immediately update the PeproDev Ultimate Invoice plugin to the latest version that eliminates the SSRF vulnerability.
Other vulnerabilities in PeproDev Ultimate Invoice
See all- CVE-2026-65510High
The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code.
- CVE-2026-65499Medium
The PeproDev Ultimate Invoice plugin versions 2.2.6 and earlier have an unauthenticated broken access control vulnerability. Unauthenticated users can gain unauthorized access to functions or data.
- CVE-2026-27372Medium
The PeproDev Ultimate Invoice plugin for WordPress versions 2.2.6 and earlier contains an unauthenticated sensitive data exposure vulnerability.
- CVE-2024-32518Medium
The PeproDev Ultimate Invoice WordPress plugin (by Pepro Dev. Group) up to version 2.0.0 has a missing authorization vulnerability that could allow unauthorized users to perform certain operations.
Original NVD description (English source)
Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.