CVE-2026-9021
MediumCVSS 5.3Summary
The Easy Invoice plugin for WordPress up to version 2.1.19 is vulnerable to Missing Authorization. It registers the easy_invoice_accept_quote and easy_invoice_decline_quote AJAX actions via wp_ajax_nopriv_ hooks, relying solely on a quote-scoped nonce rendered in the publicly accessible single quote template, combined with an off-by-default Pro option (easy_invoice_pro_restrict_quote_to_client). This allows unauthenticated attackers to accept or decline arbitrary published quotes and, depending on the configured accept action, automatically convert them into invoices (even emailing them to the client) by harvesting the per-quote nonce from the public quote page and submitting it to admin-ajax.
Risk Assessment
The organization is at risk of unauthorized quote modifications, leading to fake invoices, accounting errors, and loss of client trust. An unauthenticated attacker can accept or decline quotes and, in some configurations, generate and send invoices, causing financial and reputational damage.
Recommendation
Immediately update the Easy Invoice plugin to the latest available version. If an update is not possible, enable the easy_invoice_pro_restrict_quote_to_client option in the Pro settings to restrict quote access to logged-in clients only.
Other vulnerabilities in Easy Invoice
See all- CVE-2026-66676Medium
Unauthenticated Broken Access Control vulnerability in Easy Invoice plugin up to version 2.3.8. Unauthenticated users can access invoice and management functions that should be protected.
- CVE-2026-48836Critical
There is an unauthenticated remote code execution (RCE) vulnerability in Easy Invoice versions <= 2.1.19.
Original NVD description (English source)
The Easy Invoice plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.19. This is due to the plugin registering the easy_invoice_accept_quote and easy_invoice_decline_quote AJAX actions via wp_ajax_nopriv_ hooks and relying solely on a quote-scoped nonce that is rendered into the publicly accessible single quote template, combined with an ownership check that is gated behind an off-by-default Pro option (easy_invoice_pro_restrict_quote_to_client). This makes it possible for unauthenticated attackers to accept or decline arbitrary published quotes — and, depending on the configured accept action, automatically convert them into invoices (and even email them to the client) — by harvesting the per-quote nonce from the public quote page and submitting it to admin-ajax.