{
 "id": "WPSEC-2026-2750",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2750/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2750/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2750/index.md",
 "title": "Invoice Ninja <= 2.0.2 - Unauthenticated Price Manipulation via Negative-Price Products",
 "description": "The Invoice Ninja plugin for WordPress is vulnerable to price manipulation via the shop cart in all versions up to, and including, 2.0.2, due to product sync publishing Invoice Ninja items with a negative price (discount and credit entries) and the cart pricing them like any other product. This makes it possible for unauthenticated attackers to add such items to their cart and lower an order's total, provided the connected Invoice Ninja catalog contains negative-price items.",
 "plugin": {
  "slug": "invoiceninja",
  "name": "Invoice Ninja",
  "full_name": "Invoice Ninja",
  "wordpress_org": "https://wordpress.org/plugins/invoiceninja/",
  "advisories_url": "https://wpsec.com/vuln/plugin/invoiceninja/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/invoiceninja"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-840"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.1.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.1.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.1.0",
 "remediation": "Update to 2.1.0 or later.",
 "fix_released": "2026-11-07T17:37:40+00:00",
 "published": "2026-11-08T17:40:50+00:00",
 "updated": "2026-11-08T13:08:18.879681+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2750/",
  "https://plugins.svn.wordpress.org/invoiceninja/tags/2.1.0/",
  "https://wordpress.org/plugins/invoiceninja/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/invoiceninja",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-08"
 }
}