Unauthenticated User Data Exposure in WP-Invoice WordPress Plugin

Executive Summary

The WP-Invoice WordPress plugin through version 4.3.1 has a vulnerability where several AJAX handlers lack capability checks. This allows any authenticated user, including those with Subscriber roles, to retrieve sensitive personally identifiable information (PII) of all registered users, such as email addresses, display names, and profile details.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the WP-Invoice plugin version 4.3.1 or below is installed. Review server logs for unauthorized AJAX requests to user data endpoints. Use WordPress admin access to verify if non-privileged users can view other users' email addresses or profile details.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can expose your personal data, including email addresses and profile details, to unauthorized users. Attackers could use this information for phishing, spam, or other malicious activities targeting you or your organization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access and exposure of personally identifiable information. GDPR requires protecting personal data, and HIPAA mandates safeguarding health-related data. Non-compliance could result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the WP-Invoice plugin to the latest version if available. If no update exists, consider disabling the plugin until a patch is released. Restrict user roles to prevent Subscribers from accessing sensitive data. Monitor network traffic for unusual AJAX requests targeting user data.

Useful 0 Not Useful 0