{
 "id": "WPSEC-2026-2751",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2751/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2751/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2751/index.md",
 "title": "Invoice Ninja <= 2.0.2 - Authenticated (Subscriber+) Authentication Bypass via Unverified Email in Subscription Events",
 "description": "The Invoice Ninja plugin for WordPress is vulnerable to authentication bypass via subscription lifecycle events in all versions up to, and including, 2.0.2, due to the event payload naming any WordPress user linked to an Invoice Ninja client by email without checking that the user confirmed that email address. This makes it possible for authenticated attackers, with subscriber-level access and above, whose account was registered with a customer's email address to be named as that customer in subscription events and receive the access that event receivers grant to that user id. Exploitation requires a registration flow that lets users set their own password, the account to be linked to the client, and a receiver that provisions access from these events.",
 "plugin": {
  "slug": "invoiceninja",
  "name": "Invoice Ninja",
  "full_name": "Invoice Ninja",
  "wordpress_org": "https://wordpress.org/plugins/invoiceninja/",
  "advisories_url": "https://wpsec.com/vuln/plugin/invoiceninja/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/invoiceninja"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-290"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.2,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.0.0",
    "from_inclusive": true,
    "to": "2.1.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.0.0 before 2.1.0"
  ]
 },
 "introduced_in": "2.0.0",
 "fixed_in": "2.1.0",
 "remediation": "Update to 2.1.0 or later.",
 "fix_released": "2026-11-07T17:37:40+00:00",
 "published": "2026-11-08T17:40:50+00:00",
 "updated": "2026-11-08T13:08:18.879681+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2751/",
  "https://plugins.svn.wordpress.org/invoiceninja/tags/2.1.0/",
  "https://wordpress.org/plugins/invoiceninja/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/invoiceninja",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-08"
 }
}