Unauthorized Data Access in Invoct – PDF Invoices & Billing for WooCommerce by WordPress

CVE-2026-1748

What is CVE-2026-1748?

The Invoct – PDF Invoices & Billing plugin for WooCommerce is susceptible to unauthorized data access due to a lack of capability verification in multiple functions. This vulnerability allows authenticated users, with Subscriber-level permissions or higher, to access sensitive data, including customer invoices, invoice items, and WordPress user information, potentially leading to data leaks and privacy breaches. This issue affects all versions of the plugin up to and including version 1.6.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References