Description
The Invoice123 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the plugin's API key stored in wp_options, modify invoice plugin settings, and alter WooCommerce tax rate data in the wp_woocommerce_tax_rates table.
Published: 2026-07-10
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Invoice123 WordPress plugin suffers from an authorization bypass for certain AJAX actions, allowing authenticated subscribers or higher to overwrite the plugin’s API key, change invoice settings, and modify the WooCommerce tax rate data stored in the wp_woocommerce_tax_rates table. The flaw, a missing authorization check (CWE-862), enables this misuse.

Affected Systems

Affected sites run WordPress with the saskaita123 Invoice123 plugin version 1.7.0 or earlier. The vulnerability applies to all releases up to and including 1.7.0; no later versions are currently noted in the data.

Risk and Exploitability

The CVSS score of 4.3 indicates low to moderate severity, and the EPSS score of less than 1%. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. Attackers must have legitimate subscriber-level access, then send crafted AJAX requests to s123_submit_api_key or s123_submit_invoice_settings to execute the bypass.

Generated by OpenCVE AI on July 29, 2026 at 11:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Invoice123 plugin to the latest version that addresses the authorization bypass.
  • If immediate update is not feasible, restrict the AJAX endpoints by adding a capability check so that only administrators can invoke s123_submit_api_key and s123_submit_invoice_settings, or block these actions for subscriber-level or security plugin configuration.
  • Review the user role assignments and remove any users unnecessarily granted subscriber or higher privileges on the WordPress site, thereby limiting the set of users who can trigger the vulnerable actions.

Generated by OpenCVE AI on July 29, 2026 at 11:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Saskaita123
Saskaita123 invoice123
Wordpress
Wordpress wordpress
Vendors & Products Saskaita123
Saskaita123 invoice123
Wordpress
Wordpress wordpress

Fri, 10 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Description The Invoice123 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the plugin's API key stored in wp_options, modify invoice plugin settings, and alter WooCommerce tax rate data in the wp_woocommerce_tax_rates table.
Title Invoice123 <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Setting Modification via s123_submit_api_key & s123_submit_invoice_settings AJAX actions
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Saskaita123 Invoice123
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-10T14:03:50.477Z

Reserved: 2026-05-28T15:53:49.759Z

Link: CVE-2026-9857

cve-icon Vulnrichment

Updated: 2026-07-10T14:03:47.309Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T11:15:04Z

Weaknesses