Vulnerabilities / Invoice Ninja / WPSEC-2026-2750
Invoice Ninja <= 2.0.2 - Unauthenticated Price Manipulation via Negative-Price Products
Low 3.7
CWE-840Fixed in 2.1.0
- ID
- WPSEC-2026-2750
- Plugin
- Invoice Ninja (invoiceninja)
- Affected
- all versions before 2.1.0
- Remediation
- Update to 2.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-840
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-08
- Attack surface
- Invoice Ninja on WPSec AttackSurface
- Fix released
- Published
Description
The Invoice Ninja plugin for WordPress is vulnerable to price manipulation via the shop cart in all versions up to, and including, 2.0.2, due to product sync publishing Invoice Ninja items with a negative price (discount and credit entries) and the cart pricing them like any other product. This makes it possible for unauthenticated attackers to add such items to their cart and lower an order's total, provided the connected Invoice Ninja catalog contains negative-price items.
References
- https://wpsec.com/vuln/WPSEC-2026-2750/
- https://plugins.svn.wordpress.org/invoiceninja/tags/2.1.0/
- https://wordpress.org/plugins/invoiceninja/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS