PeproDev Ultimate Invoice WordPress Plugin Insecure Direct Object Reference Vulnerability

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the PeproDev Ultimate Invoice plugin for WordPress, affecting all versions through 2.0.8. The vulnerability arises in the invoicing viewer, where missing validation on a user-controlled key allows unauthenticated attackers to access invoices for completed orders. These invoices may contain personally identifiable information (PII) of users.

Impact

Exploitation of this vulnerability could lead to unauthorized access to invoices containing sensitive user information, including personally identifiable information (PII).