# Invoice Ninja <= 2.0.2 - Unauthenticated Price Manipulation via Negative-Price Products

- **ID:** WPSEC-2026-2750
- **Plugin:** Invoice Ninja (`invoiceninja`), https://wordpress.org/plugins/invoiceninja/
- **Affected versions:** all versions before 2.1.0
- **Fixed in:** 2.1.0 (Update to 2.1.0 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-840
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/invoiceninja
- **Fix released:** 2026-11-07
- **Published:** 2026-11-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2750/

## Description

The Invoice Ninja plugin for WordPress is vulnerable to price manipulation via the shop cart in all versions up to, and including, 2.0.2, due to product sync publishing Invoice Ninja items with a negative price (discount and credit entries) and the cart pricing them like any other product. This makes it possible for unauthenticated attackers to add such items to their cart and lower an order's total, provided the connected Invoice Ninja catalog contains negative-price items.

## References

- https://wpsec.com/vuln/WPSEC-2026-2750/
- https://plugins.svn.wordpress.org/invoiceninja/tags/2.1.0/
- https://wordpress.org/plugins/invoiceninja/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2750/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.