The WP‑Invoice WordPress plugin version 4.3.1 or older contains several AJAX endpoints that omit capability checks. This flaw lets any authenticated user—normally even a Subscriber—request and receive the email addresses, display names and profile details of every user registered on the site. The exposed information is personally identifiable and could be leveraged for phishing, social engineering, or other privacy‑violating activities.

WordPress sites running the WP‑Invoice plugin version 4.3.1 or earlier are affected. The issue resides completely within the plugin code and is independent of the core WordPress version or other plugins.

Exploit requires only valid login credentials; because the Subscriber role is commonly granted, the potential attacker pool is broad. The EPSS score of less than 1 % indicates that current exploitation attempts are rare, and the vulnerability is not listed in the CISA KEV catalog. However, the CVSS score of 4.3 reflects a moderate confidentiality impact from the unauthorized disclosure of user PII. The absence of an authentication or authorization check directly subverts data protection, making the issue a clear priority for patching.