PT-2025-7384 · WordPress · Peprodev Ultimate Invoice

Tim Coen · Published 2025-02-19 · Updated 2025-02-19 · CVE-2024-13719

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PeproDev Ultimate Invoice plugin for WordPress versions up to, and including, 2.0.8

Description The issue concerns an Insecure Direct Object Reference vulnerability in the PeproDev Ultimate Invoice plugin for WordPress. This vulnerability arises due to missing validation on a user-controlled key in the invoicing viewer. As a result, unauthenticated attackers can view invoices for completed orders, potentially accessing personally identifiable information (PII) of users.

Recommendations For versions up to, and including, 2.0.8, update to a version higher than 2.0.8 to resolve the issue. As a temporary workaround, consider restricting access to the invoicing viewer to prevent unauthenticated attackers from viewing invoices for completed orders.

Fix

IDOR

Missing Authorization

Weakness Enumeration

CWE-639

CWE-862

Related Identifiers

CVE-2024-13719

Affected Products

Peprodev Ultimate Invoice

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-13719 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13719 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3244844%40pepro-ultimate-invoice&new=3244844%40pepro-ultimate-invoice&sfp_email=&sfph_mail= · Note
• https://wordpress.org/plugins/pepro-ultimate-invoice · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/46186f8d-e50c-476a-9480-b6121412474a?source=cve · Note
• https://t.me/cvedetector/18429 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1892215566192009655 · Twitter Post
• https://twitter.com/CVEnew/status/1892119604685570343 · Twitter Post