{
 "id": "WPSEC-2026-2527",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2527/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2527/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2527/index.md",
 "title": "Számlázz.hu integráció WooCommerce-hez <= 6.3 - Unauthenticated Invoice Data Manipulation via Invoice Override Parameters",
 "description": "The Integration for Szamlazz.hu and WooCommerce plugin for WordPress is vulnerable to invoice data manipulation in all versions up to, and including, 6.3 due to the invoice generation routine reading override parameters such as 'paid', 'note', 'deadline', 'completed', 'doc_type', 'lang', 'account' and 'reason' directly from the request without verifying a nonce or the origin of the request. This makes it possible for unauthenticated customers, when invoices are generated automatically during their own requests (for example at checkout or on an automated status change), to alter the generated invoice, such as marking it as paid, injecting notes, changing the deadline or language, or switching the Számlázz.hu account used.",
 "plugin": {
  "slug": "integration-for-szamlazzhu-woocommerce",
  "name": "Számlázz.hu integráció WooCommerce-hez",
  "full_name": "Integration for Szamlazz.hu and WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/integration-for-szamlazzhu-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/integration-for-szamlazzhu-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/integration-for-szamlazzhu-woocommerce"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.3.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.3.1",
 "remediation": "Update to 6.3.1 or later.",
 "fix_released": "2026-11-03T22:05:34+00:00",
 "published": "2026-11-04T22:49:09+00:00",
 "updated": "2026-11-04T13:58:41.036498+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2527/",
  "https://plugins.svn.wordpress.org/integration-for-szamlazzhu-woocommerce/tags/6.3.1/",
  "https://wordpress.org/plugins/integration-for-szamlazzhu-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/integration-for-szamlazzhu-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}