Insecure Direct Object Reference in PeproDev Ultimate Invoice Plugin for WordPress

CVE-2024-13719

Summary

The PeproDev Ultimate Invoice plugin for WordPress is affected by a vulnerability that allows unauthorized users to access sensitive information. This is due to inadequate validation on a user-controlled key in the invoicing viewer. As a result, unauthenticated attackers can exploit this flaw to view invoices of completed orders, which may contain personal identifiable information (PII) of users. It is crucial for website administrators using this plugin to implement security measures to prevent potential data exposure.

References