This vulnerability (CWE-862) in PeproDev Ultimate Invoice versions <=2.0.0 involves missing authorization checks, which means that certain operations can be performed without proper permission validation. The CVSS 3.1 base score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or availability impact, but integrity impact is present. There is no known exploit in the wild and no vendor advisory or patch currently available.

The vulnerability allows unauthorized users to perform actions that should require authorization, leading to potential integrity violations within the affected application. There is no impact on confidentiality or availability. The medium severity reflects the potential for unauthorized modification of data or operations within the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected application and monitor for unusual activity related to authorization bypass attempts.