# All in One Invite Codes <= 1.2.0 - Cross-Site Request Forgery to Invite Code Creation

- **ID:** WPSEC-2026-0592
- **Plugin:** All in One Invite Codes (`all-in-one-invite-codes`), https://wordpress.org/plugins/all-in-one-invite-codes/
- **Affected versions:** from 1.0.6 before 1.3.0
- **Fixed in:** 1.3.0 (Update to 1.3.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/all-in-one-invite-codes
- **Fix released:** 2026-10-03
- **Published:** 2026-10-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0592/

## Description

The All in One Invite Codes plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the invite code creation AJAX action in versions 1.0.6 up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to create an invite code with a value of their choosing under a logged-in user's account, via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-0592/
- https://plugins.svn.wordpress.org/all-in-one-invite-codes/tags/1.3.0/
- https://wordpress.org/plugins/all-in-one-invite-codes/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0592/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.