CVE-2026-97183 in WP-Invoice Plugin
Summary
by MITRE • 10/11/2026
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in WP-Invoice versions up to 4.3.1 represents a critical failure in access control mechanisms within the plugin's AJAX handler architecture. Specifically, several endpoints designed for administrative or privileged operations lack proper capability verification before executing their logic. In WordPress development standards, it is mandatory that any function exposed via AJAX checks whether the current user possesses the necessary capabilities to perform the requested action. The absence of these checks means that the security boundary intended to restrict sensitive data access based on user roles is effectively bypassed by any authenticated account, regardless of its privilege level.
This flaw allows an attacker with even the lowest possible WordPress role, such as a Subscriber, to interact directly with the plugin's AJAX endpoints. By crafting specific HTTP requests to these unsecured handlers, the attacker can trigger functions that query the database for user information. The data exposed includes email addresses, display names, and various profile details of all registered users on the site. This constitutes a significant breach of confidentiality, as it transforms what should be private administrative or restricted-user data into publicly accessible information through authenticated means.
From an industry standards perspective, this vulnerability is classified under CWE-285, which describes Improper Authorization. The attack vector aligns with MITRE ATT&CK technique T1078, specifically Valid Accounts, as the exploitation relies on legitimate credentials to access resources that should be restricted. Furthermore, it relates to CWE-639, Injection into Command or Shell, if the AJAX handlers also facilitated data retrieval through poorly sanitized inputs, though in this specific case, the primary issue is the lack of authorization checks rather than input validation failures. The exposure of personally identifiable information (PII) such as email addresses and profile details can lead to secondary attacks including phishing campaigns, credential stuffing, or social engineering efforts targeting individual users within the organization or community using the WordPress site.
The operational impact extends beyond simple data leakage. For businesses relying on WP-Invoice for billing and client management, this exposure undermines trust with clients whose personal information is compromised. It also facilitates further reconnaissance by attackers who can use the harvested email addresses to map out user hierarchies and identify high-value targets within the system. This level of access control failure indicates a fundamental gap in the plugin's security design during its development lifecycle, where role-based access control was not rigorously enforced across all public-facing endpoints.
To mitigate this vulnerability, site administrators must immediately update WP-Invoice to version 4.3.2 or later, which includes patches for these authorization checks. Until an update is applied, it is advisable to disable the plugin entirely if its features are not actively required, thereby removing the attack surface from the web server. Additionally, implementing a Web Application Firewall can help detect and block suspicious AJAX requests that attempt to access restricted endpoints without proper authentication tokens or capabilities. Regular security audits of WordPress plugins should include verification that all AJAX handlers implement capability checks using functions such as current_user_can in PHP, ensuring that only users with appropriate roles like Administrator or Editor can execute sensitive operations.