{
 "id": "WPSEC-2026-2379",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2379/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2379/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2379/index.md",
 "title": "Invoice Ninja <= 1.0.11 - Unauthenticated Missing Authorization to Invoice Creation and Client Data Access via Purchase, Checkout and Client Portal Shortcodes",
 "description": "The Invoice Ninja plugin for WordPress is vulnerable to unauthorized access to client records via the [invoiceninja_purchase], [invoiceninja_checkout] and [invoiceninja_client_portal] shortcode handlers in all versions up to, and including, 1.0.11. This is due to missing login checks before these handlers look up the Invoice Ninja client by the current user's email address, and ClientApi::find() not rejecting an empty email. For a logged-out visitor the email is empty, and the Invoice Ninja API ignores an empty email filter and returns all clients, so the plugin acts on the first existing client. This makes it possible for unauthenticated attackers to create invoices against another customer's client record and be redirected to that invoice's client invitation link, which exposes that customer's invoice and client details. When that client has a contact without an email address, the attacker can also be redirected to that contact's client portal login link.",
 "plugin": {
  "slug": "invoiceninja",
  "name": "Invoice Ninja",
  "full_name": "Invoice Ninja",
  "wordpress_org": "https://wordpress.org/plugins/invoiceninja/",
  "advisories_url": "https://wpsec.com/vuln/plugin/invoiceninja/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/invoiceninja"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.0.15",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.0.15"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.0.15",
 "remediation": "Update to 1.0.15 or later.",
 "fix_released": "2026-11-01T09:25:17+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:41:22.543687+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2379/",
  "https://plugins.svn.wordpress.org/invoiceninja/tags/1.0.15/",
  "https://wordpress.org/plugins/invoiceninja/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/invoiceninja",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}