CVE-2024-13719

MITTEL 5.3CVE-2024-13719 · Published 19/02/2025 · updated 17/06/2026

Kurz gesagt

CVE-2024-13719 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in peprodev ultimate invoice (pepro).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.48%, höher als bei 41.5% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
peprodev ultimate invoice pepro	`≤ 2.0.8`	No fix yet

Description

The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for completed orders which can contain PII of users.

References

plugins.trac.wordpress.org/changeset
wordpress.org/plugins/pepro-ultimate-invoice · Product
wordfence.com/threat-intel/vulnerabilities/id/46186f8d-e50c-476a-9480-b6121412474a · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free