CVE-2026-9021 in Easy Invoice Plugin
Summary
by MITRE • 07/09/2026
The Easy Invoice plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.19. This is due to the plugin registering the easy_invoice_accept_quote and easy_invoice_decline_quote AJAX actions via wp_ajax_nopriv_ hooks and relying solely on a quote-scoped nonce that is rendered into the publicly accessible single quote template, combined with an ownership check that is gated behind an off-by-default Pro option (easy_invoice_pro_restrict_quote_to_client). This makes it possible for unauthenticated attackers to accept or decline arbitrary published quotes — and, depending on the configured accept action, automatically convert them into invoices (and even email them to the client) — by harvesting the per-quote nonce from the public quote page and submitting it to admin-ajax.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/09/2026
The Easy Invoice WordPress plugin contains a critical authorization vulnerability that affects versions up to and including 2.1.19, representing a significant security risk for WordPress installations. This vulnerability stems from improper access control mechanisms within the plugin's AJAX handling system, where the plugin registers two critical actions - easy_invoice_accept_quote and easy_invoice_decline_quote - through wp_ajax_nopriv_ hooks that are designed for unauthenticated users. The flaw creates a dangerous situation where publicly accessible functionality can be exploited by unauthorized parties, as these actions do not properly verify user authentication or authorization before executing their respective functions.
The technical implementation of this vulnerability involves the plugin's reliance on quote-scoped nonces that are embedded directly into publicly accessible single quote templates, creating a fundamental security flaw in the nonce distribution mechanism. These nonces, which should typically be protected and validated through proper authentication checks, are rendered visible to anyone who can access the public quote page, effectively allowing attackers to harvest valid nonces for arbitrary quotes. The vulnerability is further exacerbated by the fact that the ownership validation check, which should prevent unauthorized modifications, is gated behind an off-by-default Pro option called easy_invoice_pro_restrict_quote_to_client, meaning that even in default installations, this critical protection mechanism is not active.
The operational impact of this vulnerability extends beyond simple unauthorized access to potentially enable full automation of business processes that should remain restricted to authorized personnel. Attackers who exploit this vulnerability can programmatically accept or decline any published quote on the website, with the potential for automatic conversion of accepted quotes into invoices and subsequent email notifications to clients. This creates a scenario where malicious actors could generate fraudulent invoices, disrupt business workflows, and potentially cause financial harm to businesses relying on the plugin. The severity is particularly concerning because it allows attackers to manipulate the core invoicing workflow without any authentication requirements.
This vulnerability aligns with CWE-863 (Incorrect Authorization) and represents a classic case of insufficient access control validation in web applications. From an ATT&CK framework perspective, this issue maps to T1078 (Valid Accounts) and T1566 (Phishing) as attackers can exploit the publicly available nonce mechanism without needing valid credentials, while also potentially enabling further reconnaissance activities. The vulnerability demonstrates poor security design principles where the plugin assumes that the presence of a nonce provides sufficient security isolation, failing to recognize that nonces alone cannot provide authorization when they are exposed in public contexts. Organizations should immediately implement mitigations including immediate plugin updates to versions that address this issue, or alternatively, disabling the affected AJAX actions through custom code modifications until proper authentication mechanisms can be implemented.
The broader implications highlight how third-party plugins can introduce critical security gaps even when they appear to follow standard WordPress development practices. This vulnerability underscores the importance of comprehensive security auditing for all plugin components, particularly those involving AJAX handlers and user-facing functionality that may expose system-level operations. Security professionals should conduct thorough reviews of similar plugins to identify whether they implement proper authorization checks before executing privileged actions, especially when dealing with financial or business-critical workflows. The incident serves as a reminder that even default installations can contain dangerous security flaws when proper access control mechanisms are not properly implemented and validated.