Invoice Ninja <= 2.0.2 - Authenticated (Subscriber+) Authentication Bypass via Unverified Email in Subscription Events
- ID
- WPSEC-2026-2751
- Plugin
- Invoice Ninja (invoiceninja)
- Affected
- from 2.0.0 before 2.1.0
- Remediation
- Update to 2.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-290
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-08
- Attack surface
- Invoice Ninja on WPSec AttackSurface
- Fix released
- Published
Description
The Invoice Ninja plugin for WordPress is vulnerable to authentication bypass via subscription lifecycle events in all versions up to, and including, 2.0.2, due to the event payload naming any WordPress user linked to an Invoice Ninja client by email without checking that the user confirmed that email address. This makes it possible for authenticated attackers, with subscriber-level access and above, whose account was registered with a customer's email address to be named as that customer in subscription events and receive the access that event receivers grant to that user id. Exploitation requires a registration flow that lets users set their own password, the account to be linked to the client, and a receiver that provisions access from these events.
References
- https://wpsec.com/vuln/WPSEC-2026-2751/
- https://plugins.svn.wordpress.org/invoiceninja/tags/2.1.0/
- https://wordpress.org/plugins/invoiceninja/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS