CVE-2026-66676
MediumCVSS 5.3Summary
Unauthenticated Broken Access Control vulnerability in Easy Invoice plugin up to version 2.3.8. Unauthenticated users can access invoice and management functions that should be protected.
Risk Assessment
An attacker can view or modify invoices, potentially leaking financial data of the company or clients. This may compromise data confidentiality and integrity.
Recommendation
Update the Easy Invoice plugin to version 2.3.9 or later. Also, configure proper access rules and monitor logs.
Other vulnerabilities in Easy Invoice
See all- CVE-2026-9021Medium
The Easy Invoice plugin for WordPress up to version 2.1.19 is vulnerable to Missing Authorization. It registers the easy_invoice_accept_quote and easy_invoice_decline_quote AJAX actions via wp_ajax_nopriv_ hooks, relying solely on a quote-scoped nonce rendered in the publicly accessible single quote template, combined with an off-by-default Pro option (easy_invoice_pro_restrict_quote_to_client). This allows unauthenticated attackers to accept or decline arbitrary published quotes and, depending on the configured accept action, automatically convert them into invoices (even emailing them to the client) by harvesting the per-quote nonce from the public quote page and submitting it to admin-ajax.
- CVE-2026-48836Critical
There is an unauthenticated remote code execution (RCE) vulnerability in Easy Invoice versions <= 2.1.19.
Original NVD description (English source)
Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.