Easy Invoice vulnerabilities

Unauthenticated Broken Access Control vulnerability in Easy Invoice plugin up to version 2.3.8. Unauthenticated users can access invoice and management functions that should be protected.

The Easy Invoice plugin for WordPress up to version 2.1.19 is vulnerable to Missing Authorization. It registers the easy_invoice_accept_quote and easy_invoice_decline_quote AJAX actions via wp_ajax_nopriv_ hooks, relying solely on a quote-scoped nonce rendered in the publicly accessible single quote template, combined with an off-by-default Pro option (easy_invoice_pro_restrict_quote_to_client). This allows unauthenticated attackers to accept or decline arbitrary published quotes and, depending on the configured accept action, automatically convert them into invoices (even emailing them to the client) by harvesting the per-quote nonce from the public quote page and submitting it to admin-ajax.

There is an unauthenticated remote code execution (RCE) vulnerability in Easy Invoice versions <= 2.1.19.