Skip to content
Sign in
4.3 Medium

CVE-2026-97183 The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers,…

Description

The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.

Affected products and versions

Product Affected versions Fixed in
WP-Invoice 4.3 earliest → 4.3.1 No fix stated

Other CVEs of WP-Invoice

The 2 CVEs of WP-Invoice →
CVE-2022-1617 The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is… 6.1 Medium
Track this CVE