CVE-2026-2343 Details
Description
The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII.
A vulnerability in the PeproDev Ultimate Invoice WordPress plugin, affecting versions through 2.2.5, allows for unauthorized access to personal identifiable information (PII). The issue arises from a bulk download invoices feature that creates ZIP files containing exported invoice PDFs. These ZIP files are named in a predictable manner, enabling brute force attacks to retrieve the archived invoices and the sensitive data they contain.
Users are advised to update the PeproDev Ultimate Invoice WordPress plugin to version 2.2.6 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 25, 2026CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/ac1572ca-7994-401d-a268-6a8773e60ab1/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| PeproDev Ultimate Invoice | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 25, 2026 | CVE Modified | CISA-ADP |
| Mar 25, 2026 | New CVE Received | [email protected] |