Vulnerability · Published Feb 19, 2025 · Assigned by Wordfence
CVE-2024-13719PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure
Medium 5.3
In plain English
A medium-severity missing authorization in PeproDev Ultimate Invoice from peprodev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Official description
The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for completed orders which can contain PII of users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| peprodev | PeproDev Ultimate Invoice | 0 – through 2.0.9 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/46186f8d-e50c-476a-9480-b6121412474a?source=cve
- https://wordpress.org/plugins/pepro-ultimate-invoice/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3244844%40pepro-ultimate-invoice&new=3244844%40pepro-ultimate-invoice&sfp_email=&sfph_mail=