Junglewise Threat Intelligence

CVE-2026-9021: WordPress Easy Invoice missing authorization in quote management

CVE-2026-9021 · Severity: medium · CVSS 5.3 · Published 2026-07-09

Executive brief

The Easy Invoice plugin for WordPress, which manages business quotes and invoices, contains a security flaw that allows unauthorized individuals to manipulate customer quotes. An attacker can remotely accept or decline quotes on behalf of legitimate clients without needing to log in. This could lead to unauthorized invoice generation and automated emails being sent to customers, potentially disrupting business operations and damaging professional reputation.

Technical details

The Easy Invoice plugin for WordPress is vulnerable to Missing Authorization due to the improper implementation of AJAX actions. Specifically, the 'easy_invoice_accept_quote' and 'easy_invoice_decline_quote' actions are registered via 'wp_ajax_nopriv_' hooks but rely on a quote-scoped nonce that is publicly visible in the single quote template. Furthermore, the ownership check is only active if a specific 'Pro' version setting is enabled. An unauthenticated attacker can harvest the nonce from a public quote page and submit it to 'admin-ajax.php' to manipulate the status of any published quote. Depending on the plugin configuration, this can trigger the automatic conversion of quotes into invoices and initiate automated emails to clients.

Affected products

  • matrixaddons Easy Invoice – Invoice Generator, PDF Quotes & Payments up to and including 2.1.19

Timeline

  • 2026-07-09: advisory: NVD publication date

References