Insufficient Access Controls in WP-Invoice Plugin for WordPress
CVE-2026-97183
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-97183?
The WP-Invoice plugin for WordPress prior to version 4.3.1 contains significant access control weaknesses in its AJAX handlers. These vulnerabilities enable any authenticated user, including those with minimal permissions like Subscribers, to access sensitive information. This includes email addresses, display names, and profile details of all registered users, creating a potential for unauthorized data exposure and privacy breaches.
Affected Version(s)
WP-Invoice 0 <= 4.3.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.