CVE-2024-13719CWE-862

PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure

Medium · published February 19, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for completed orders which can contain PII of users.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00477 · 40.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-02-19T07:32Z
EPSS history
Timeline
  • 19 FEB 07:32Z
    PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure
    cvelistv5