Atomic Edge analysis of CVE-2026-27372 (metadata-based): The PeproDev Ultimate Invoice plugin for WordPress, versions up to and including 2.2.6, exposes sensitive information to unauthenticated attackers. The vulnerability has a CVSS score of 5.3 (Medium) and is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. No patched version is available, and the vulnerable plugin is not downloadable from WordPress.org, so this analysis is based on metadata and common WordPress plugin patterns.
The root cause of this vulnerability stems from missing authorization or access control checks on one or more endpoints that return sensitive data. In WordPress plugins, this commonly occurs in AJAX handlers, REST API routes, or directly accessible PHP files that fail to verify the current user’s capabilities or authenticate the request. Since the vulnerability affects all versions up to and including 2.2.6 and requires no authentication, an insecure function likely uses a nonce check that is not enforced, or a hook that is registered with the wrong action (e.g., using ‘wp_ajax_’ instead of also checking ‘wp_ajax_nopriv_’). Atomic Edge analysis infers that at least one endpoint reads user data, configuration options, or database rows and returns them without proper access controls. This conclusion is inferred from the CWE classification and the generic description; without source code, we cannot confirm the exact endpoint or the type of data exposed.
Exploitation requires no authentication and no user interaction. An attacker can send a crafted HTTP request to a vulnerable endpoint, such as an AJAX handler or REST API route, using the plugin’s common URL patterns. Based on common plugin naming, likely endpoints include ‘/wp-admin/admin-ajax.php?action=pepro_dev_invoice_download’ or ‘/wp-json/pepro/v1/invoice’. The request would include parameters specifying which data to retrieve, such as an invoice ID, user ID, or configuration key. For example, an attacker could attempt to download an invoice by ID, which might expose personal information of the customer, or call an endpoint that returns database credentials stored in the plugin’s settings. The attack succeeds because the endpoint does not validate the requester’s role or the existence of a valid nonce.
Remediation requires adding proper authorization checks to every endpoint that accesses sensitive data. The plugin must verify that unauthenticated access is blocked, and for authenticated users, capability checks (e.g., ‘current_user_can()’) must confirm the required permission level. Additionally, nonces should be validated on all state-changing or data-retrieval requests. Server-side validation is essential; relying on client-side checks is insufficient. Since no patched version is available, administrators should mitigate the risk by disabling the plugin or applying a virtual patch at the WAF level to block direct access to any potentially vulnerable endpoints. A proactive security review of all AJAX and REST endpoints in the plugin is recommended to identify and fix any other missing authorization checks.
If exploited, this vulnerability exposes sensitive data to unauthorized parties. The exact impact depends on the information accessible. At a minimum, it could reveal user details such as names, email addresses, and billing information. It could also leak configuration data, including database credentials, API keys, or payment gateway settings, which would allow an attacker to further compromise the site. While the CVSS score is Medium due to the low confidentiality impact and lack of integrity or availability effects, the real-world impact can be severe if the exposed data includes credentials or personally identifiable information. This can lead to identity theft, further unauthorized access, and compliance violations under data protection regulations.
