Vulnerability · Published Jul 10, 2026 · Assigned by Wordfence

CVE-2026-9857Invoice123 <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Setting Modification via s123_submit_api_key & s123_submit_invoice_settings AJAX actions

Medium 4.3

In plain English

A medium-severity missing authorization in Invoice123 from saskaita123. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 59.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Invoice123 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the plugin's API key stored in wp_options, modify invoice plugin settings, and alter WooCommerce tax rate data in the wp_woocommerce_tax_rates table.

Affected products (as reported)

Vendor	Product	Versions
saskaita123	Invoice123	0 – through 1.7.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In plain English

Official description

Affected products (as reported)

References