CVE-2026-2343

PeproDev Ultimate Invoice <= 2.2.5 - Unauthenticated Invoice Archive Download

The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII.

Affected

PeproDev Ultimate Invoice

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.20% chance of exploitation in the next 30 days, 9th percentile

Published

2026-03-25

Updated

2026-04-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ac1572ca-7994-401d-a268-6a8773e60ab1/

References

• CVE Record
• NVD entry