Missing Authorization in Easy Invoice WordPress Plugin

Executive Summary

The Easy Invoice plugin for WordPress has a Missing Authorization vulnerability in versions up to and including 2.1.19. This occurs because the plugin registers certain AJAX actions (easy_invoice_accept_quote and easy_invoice_decline_quote) that can be triggered without authentication (via wp_ajax_nopriv_ hooks). The plugin relies only on a nonce tied to each quote, which is publicly accessible on the single quote page. Additionally, an ownership check that would restrict actions to the quote owner is disabled by default unless a Pro option is enabled. As a result, unauthenticated attackers can harvest the nonce from the public quote page and use it to accept or decline any published quote, potentially converting quotes into invoices and even emailing them to clients.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the Easy Invoice WordPress plugin registering AJAX actions (easy_invoice_accept_quote and easy_invoice_decline_quote) via wp_ajax_nopriv_ hooks, which can be exploited by unauthenticated attackers. Detection can focus on monitoring for suspicious HTTP POST requests to admin-ajax.php containing these action parameters.

• Use network monitoring or web server logs to identify POST requests to admin-ajax.php with parameters 'action=easy_invoice_accept_quote' or 'action=easy_invoice_decline_quote'.
• Example command to search web server logs (e.g., Apache) for such requests: grep 'admin-ajax.php' /var/log/apache2/access.log | grep -E 'action=easy_invoice_accept_quote|action=easy_invoice_decline_quote'
• Use tools like curl or Burp Suite to test if these AJAX endpoints are accessible without authentication by sending POST requests with the relevant action parameters and observing the response.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to manipulate published quotes by accepting or declining them without proper authorization. Depending on the plugin's configuration, attackers can automatically convert these quotes into invoices and send them to clients via email. This can lead to unauthorized financial transactions, confusion for clients, and potential reputational damage for the business using the plugin.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the Easy Invoice plugin to a version later than 2.1.19 where the issue is fixed.

If updating is not immediately possible, consider disabling or restricting access to the vulnerable AJAX actions by removing or restricting the wp_ajax_nopriv_ hooks in the plugin code or via security plugins/firewalls.

Enable the Pro option 'easy_invoice_pro_restrict_quote_to_client' if available, as it gates the ownership check that helps prevent unauthorized actions.

Monitor logs for suspicious activity targeting these AJAX endpoints and consider implementing web application firewall (WAF) rules to block unauthorized requests.

Useful 0 Not Useful 0