medium4.3
CVE-2026-97183
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Su…
Impact
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.
Affected products
| Product | Affected versions |
|---|---|
| WP-Invoice WordPress Plugin | through 4.3.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.