CVE-2026-2343 PeproDev Ultimate Invoice <= 2.2.5 - Unauthenticated Invoice Archive Download
Attackers can brute force predictable ZIP filenames to download unauthenticated invoice archives containing sensitive PII.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2343?
CVE-2026-2343 is a medium-severity vulnerability in Unknown PeproDev Ultimate Invoice, published on 25 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII.
Which versions are affected by CVE-2026-2343?
How do I fix CVE-2026-2343?
No fix has been published for CVE-2026-2343 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-2343 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-2343 exists.
Sources
Also known as GHSA-w7c9-8pqp-97mg.