Security Alert Summary
The Invoct 6 PDF Invoices & Billing for WooCommerce plugin for WordPress contains a missing capability check on multiple functions in all versions up to and including 1.6. Authenticated users with Subscriber-level access and above can retrieve invoice clients, invoice items, and a list of WordPress users including their email addresses.
CVE Details
- CVE ID: CVE-2026-1748
- Affected plugin / component: Invoct 6 PDF Invoices & Billing for WooCommerce plugin for WordPress
- Affected versions: All versions up to and including 1.6
- Published: February 11, 2026 at 9:15 AM (UTC)
- Last modified: February 11, 2026 at 3:27 PM (UTC)
- CVSS v3.1: Base Score 4.3 — MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Authentication / privileges / user interaction: Requires an authenticated user with low privileges (Subscriber-level and above). No user interaction required.
- Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- CWE: CWE-862 (Missing Authorization)
Technical Details
The vulnerability is caused by a missing capability check on multiple functions within the plugin, which allows authenticated users with low-level privileges to access data they should not be authorized to view. Specifically, the issue exists in the plugin code referenced in KirilKirkovWpInvoices.php (see the provided references pointing to lines in the 1.6 tag). Because the plugin fails to verify required capabilities before returning invoice-related data, Subscriber-level accounts can retrieve invoice clients, invoice items, and a list of WordPress users including email addresses.
The issue does not, in the provided description, reference exploitation of integrity or availability. The primary impact is unauthorized disclosure of information due to missing authorization checks.
How This Could Impact Your Website
Consider a small WooCommerce store where the site owner manages invoices, an internal staff member handles customer service, and an external contractor occasionally assists with order reports. If a contributor or subscriber-level account is present for testing or for a contractor, that account could access invoice clients, invoice items, and the site’s user list with email addresses without additional authorization checks.
Practical consequences include exposure of internal and customer email addresses and order-related metadata, which can increase the risk of targeted phishing or social engineering against staff or customers. The vulnerability does not, based on the provided data, indicate modification of data or denial of service, but it does raise confidentiality concerns for your user and customer information.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Review and reduce unnecessary user roles, especially accounts with Contributor/Subscriber access that do not require access to invoices or user lists.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior or unexpected access to invoice-related endpoints.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/kirilkirkov-pdf-invoice-manager/tags/1.6/KirilKirkovWpInvoices.php#L565
- https://plugins.trac.wordpress.org/browser/kirilkirkov-pdf-invoice-manager/tags/1.6/KirilKirkovWpInvoices.php#L585
- https://plugins.trac.wordpress.org/browser/kirilkirkov-pdf-invoice-manager/tags/1.6/KirilKirkovWpInvoices.php#L605
- https://plugins.trac.wordpress.org/browser/kirilkirkov-pdf-invoice-manager/tags/1.6/KirilKirkovWpInvoices.php#L626
- https://www.wordfence.com/threat-intel/vulnerabilities/id/79e4b7e1-9fff-4ff2-be2b-6dfa5f1ff48a?source=cve
Note: The CVE entry indicates the vulnerability and affected versions; it does not specify a fixed or patched version in this entry.
