The vulnerability in the Invoct – PDF Invoices & Billing for WooCommerce plugin arises from a missing capability check on several functions across all versions up to 1.6. Authenticated users with a Subscriber role or higher can invoke these functions and retrieve sensitive data, including invoice client details, line item information, and a full list of WordPress users with their email addresses. This constitutes a direct information disclosure that could support phishing, credential stuffing, or further lateral movement within the site. The weakness is identified as CWE‑862: Missing Authorization.

Affected systems are the Invoct – PDF Invoices & Billing for WooCommerce WordPress plugin from vendor kirilkirkov, with all releases up to version 1.6. No other products are reported as affected.

The CVSS v3.1 score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% shows a very low likelihood of current exploitation. The flaw is not listed in the CISA KEV catalog, implying no confirmed public exploits. Attackers must be authenticated, holding at least a Subscriber role, limiting initial reach but still allowing harvesting of confidential customer and user details once authenticated. Prompt patching, coupled with monitoring for unauthorized data extraction, mitigates this risk effectively.