WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection flaw that lets an attacker insert arbitrary SQL code through the 'post' parameter on the admin.php endpoint. By forging a request with action=duplicate_quote_invoice and a malicious 'post' value, the attacker can read sensitive tables or alter data. This results in loss of data confidentiality and integrity for the affected WordPress site.

The vulnerability exists in the Sliced Invoices plugin for WordPress, version 3.8.2. Only systems that have installed this plugin and have authenticated administrators are at risk.

The CVSS score of 7.1 classifies the issue as high severity, although no EPSS score is published and it is not listed in the CISA KEV catalog. Exploitation requires a legitimate admin login; once authenticated, an attacker can craft a POST request to the admin.php page and inject SQL code. Because the attack is locally authenticated, the scope is limited to data within the WordPress database, potentially affecting all stored invoices and quotes. The lack of public exploitation data suggests the vulnerability may not yet be commonly targeted, but the high severity and availability of the injection point warrant immediate attention.