Sliced Invoices WordPress Plugin Missing Authorization Vulnerability

A missing authorization vulnerability has been identified in the Sliced Invoices WordPress plugin, specifically in versions through 3.9.5. This vulnerability allows for insecure direct object references, which could enable a malicious actor to bypass authorization and access sensitive files or interact with the database.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive data or files, allowing for potential manipulation of database contents.

Remediation

Users of the Sliced Invoices WordPress plugin should update to version 3.9.5 or later. For those unable to update, Patchstack offers a virtual patching service that can auto-mitigate this vulnerability.