The PeproDev Ultimate Invoice plugin for WordPress suffers from an Insecure Direct Object Reference vulnerability due to missing validation on a user-controlled key in the invoicing viewer component. This flaw allows unauthenticated attackers to view invoices associated with completed orders, potentially exposing sensitive user PII. The issue affects all versions up to and including 2.0.9. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no indication of known exploits in the wild or available patches.

An attacker without authentication can access invoice data for completed orders, which may include personally identifiable information of users. This exposure can lead to privacy violations and potential misuse of sensitive data. There is no reported impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the invoicing viewer component and monitor for unauthorized access attempts. Avoid exposing invoice URLs or keys publicly. Follow vendor updates closely for any released patches or official mitigations.