Easy Invoice – Invoice Generator, PDF Quotes & Payments: A security weakness

Easy Invoice – Invoice Generator, PDF Quotes & Payments is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.2.19.

CVE / CNA score 5.3 CVSS 3.1 · security@wordfence.com

NVD score Pending NVD has not published its own CVSS assessment.

Component: Easy Invoice – Invoice Generator, PDF Quotes & Payments
Plugin slug: easy-invoice
Affected: <= 2.2.19
Safe version: > 2.2.19
Published: Jul 09, 2026
Weakness: CWE-862 — Missing Authorization

This CVE was published Jul 09, 2026 and is one of 4 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Easy Invoice – Invoice Generator, PDF Quotes & Payments to a release after 2.2.19, or disable and remove it until a fixed version is available.

Source record

Technical description

The Easy Invoice plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.19. This is due to the plugin registering the easy_invoice_accept_quote and easy_invoice_decline_quote AJAX actions via wp_ajax_nopriv_ hooks and relying solely on a quote-scoped nonce that is rendered into the publicly accessible single quote template, combined with an ownership check that is gated behind an off-by-default Pro option (easy_invoice_pro_restrict_quote_to_client). This makes it possible for unauthenticated attackers to accept or decline arbitrary published quotes — and, depending on the configured accept action, automatically convert them into invoices (and even email them to the client) — by harvesting the per-quote nonce from the public quote page and submitting it to admin-ajax.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Patch or disable the affected component.

Technical description

Primary and upstream sources