CVE-2026-2343

The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.20% chance of exploitation in the next 30 days, 10th percentile

Published

2026-03-25

Updated

2026-04-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ac1572ca-7994-401d-a268-6a8773e60ab1/

References

• CVE Record
• NVD entry

Related

• CVE-2026-23416
• CVE-2026-23479
• CVE-2026-23415
• CVE-2026-23482
• CVE-2026-23398
• CVE-2026-23483