The Easy Invoice WordPress plugin lacks proper authorization checks for accepting or declining quotes. The AJAX actions easy_invoice_accept_quote and easy_invoice_decline_quote are registered on the wp_ajax_nopriv hook, exposing them to unauthenticated users. The plugin relies on a quote‑specific nonce that is rendered into the public quote template, and the ownership check is gated behind an optional Pro setting that is off by default. As a result, an attacker can harvest the nonce from any publicly visible quote page and submit a request to admin‑ajax.php to accept or decline the quote, thereby converting it into an invoice, potentially emailing it to the client. This flaw allows unauthorized creation of financial documents and disclosure of client data. The weakness is a missing authorization flaw (CWE‑862).

Site owners running any version of the matrixaddons Easy Invoice – Invoice Generator, PDF Quotes & Payments plugin up to and including 2.1.19 have public quote pages that are accessible to anyone. The vulnerability is present in all these versions because the insecure AJAX callbacks are hard‑coded and the Pro ownership check remains disabled by default. Displaying the quote page on public-facing URLs exposes the nonce and the flaw to unauthenticated access.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the present time. The flaw is not listed in CISA’s KEV catalog, so there is no known widespread exploitation. Attackers can trivially exploit the issue by accessing a public quote page, retrieving the nonce, and submitting a crafted request to admin‑ajax.php with the desired action. No authentication or additional privileges are required, making the risk persistent until the plugin is patched or mitigated.