CVE-2026-97183 WP-Invoice CVE debrief

Who should care

Defenders responsible for WordPress installations using the WP-Invoice plugin should assess exposure and prioritize verification and remediation efforts. This includes reviewing the plugin version, restricting access to sensitive user information, and considering upgrades to patched versions. Security teams and vulnerability management teams should also review the vulnerability and plan for remediation.

Why it matters

CVE-2026-97183 is a vulnerability in the WP-Invoice WordPress plugin that allows authenticated users to retrieve sensitive user information. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and restrict access to sensitive user information.

• Potential unauthorized access to sensitive user information
• Possible data breaches due to inadequate access controls

Technical summary

The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users. This vulnerability allows attackers to access sensitive user information without proper authorization, potentially leading to data breaches and unauthorized access. The vulnerability is caused by a lack of proper authorization checks in the plugin's AJAX handlers.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and restrict access to sensitive user information.

Recommended defensive actions

• Verify the presence of WP-Invoice plugin version 4.3.1 or earlier in your WordPress installation
• Restrict access to sensitive user information
• Consider upgrading to a patched version of the WP-Invoice plugin
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being a WordPress plugin vulnerability report from WPScan. The vulnerability was reported by WPScan, which provides details on the vulnerability. However, the report's scope, severity, and vendor guidance need review. Defenders should verify the presence of WP-Invoice plugin version 4.3.1 or earlier in their WordPress installation and assess potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.