Invoice Ninja <= 1.0.11 - Unauthenticated Missing Authorization to Invoice Creation and Client Data Access via Purchase, Checkout and Client Portal Shortcodes
- ID
- WPSEC-2026-2379
- Plugin
- Invoice Ninja (invoiceninja)
- Affected
- all versions before 1.0.15
- Remediation
- Update to 1.0.15 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Invoice Ninja on WPSec AttackSurface
- Fix released
- Published
Description
The Invoice Ninja plugin for WordPress is vulnerable to unauthorized access to client records via the [invoiceninja_purchase], [invoiceninja_checkout] and [invoiceninja_client_portal] shortcode handlers in all versions up to, and including, 1.0.11. This is due to missing login checks before these handlers look up the Invoice Ninja client by the current user's email address, and ClientApi::find() not rejecting an empty email. For a logged-out visitor the email is empty, and the Invoice Ninja API ignores an empty email filter and returns all clients, so the plugin acts on the first existing client. This makes it possible for unauthenticated attackers to create invoices against another customer's client record and be redirected to that invoice's client invitation link, which exposes that customer's invoice and client details. When that client has a contact without an email address, the attacker can also be redirected to that contact's client portal login link.
References
- https://wpsec.com/vuln/WPSEC-2026-2379/
- https://plugins.svn.wordpress.org/invoiceninja/tags/1.0.15/
- https://wordpress.org/plugins/invoiceninja/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS