# Invoice Ninja <= 2.0.2 - Authenticated (Subscriber+) Authentication Bypass via Unverified Email in Subscription Events

- **ID:** WPSEC-2026-2751
- **Plugin:** Invoice Ninja (`invoiceninja`), https://wordpress.org/plugins/invoiceninja/
- **Affected versions:** from 2.0.0 before 2.1.0
- **Fixed in:** 2.1.0 (Update to 2.1.0 or later.)
- **Severity:** Medium 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-290
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/invoiceninja
- **Fix released:** 2026-11-07
- **Published:** 2026-11-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2751/

## Description

The Invoice Ninja plugin for WordPress is vulnerable to authentication bypass via subscription lifecycle events in all versions up to, and including, 2.0.2, due to the event payload naming any WordPress user linked to an Invoice Ninja client by email without checking that the user confirmed that email address. This makes it possible for authenticated attackers, with subscriber-level access and above, whose account was registered with a customer's email address to be named as that customer in subscription events and receive the access that event receivers grant to that user id. Exploitation requires a registration flow that lets users set their own password, the account to be linked to the client, and a receiver that provisions access from these events.

## References

- https://wpsec.com/vuln/WPSEC-2026-2751/
- https://plugins.svn.wordpress.org/invoiceninja/tags/2.1.0/
- https://wordpress.org/plugins/invoiceninja/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2751/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.