VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Apr 17, 2024· Updated Apr 28, 2026

CVE-2024-32518

CVE-2024-32518

Description

Missing Authorization vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice.This issue affects PeproDev Ultimate Invoice: from n/a through 2.0.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2

Patches

Vulnerability mechanics

Root cause

"Missing authorization checks on invoice AJAX actions and REST endpoints allow unauthenticated modification of invoice settings."

Attack vector

An unauthenticated attacker can send crafted HTTP requests to the plugin's AJAX handlers or REST API endpoints that lack a `current_user_can()` or similar capability check [CWE-862]. Because the plugin does not verify the user's role or permissions before processing invoice configuration changes or invoice downloads, any remote attacker who can reach the WordPress installation can exploit the missing authorization to alter invoice templates, toggle settings, or access invoice data without authentication.

Affected code

The PeproDev Ultimate Invoice plugin for WordPress (versions through 2.0.0) fails to enforce authorization checks on invoice-related AJAX actions and REST endpoints, allowing unauthenticated users to modify invoice settings or trigger invoice generation without proper capability verification.

What the fix does

The advisory does not include a published patch diff. The vendor's changelog entries for later versions (v2.2.2 and v2.2.6) reference fixes for "Security Issue CVE-2025-54869" and "Randomized invoice archive filenames and removed files after download," but no specific patch for CVE-2024-32518 is shown. Remediation requires adding WordPress capability checks (e.g., `current_user_can('manage_woocommerce')`) to all invoice AJAX callbacks and REST routes that modify or retrieve invoice data.

Preconditions

  • configThe WordPress site must have the PeproDev Ultimate Invoice plugin installed and activated (version ≤ 2.0.0).
  • authNo authentication or session is required; the attacker can be any remote user who can send HTTP requests to the WordPress installation.
  • networkThe attacker must be able to reach the WordPress admin-ajax.php or REST API endpoints exposed by the plugin.
  • inputThe attacker sends crafted POST/GET parameters that trigger the vulnerable AJAX action or REST route.

Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

1

News mentions

0

No linked articles in our index yet.