CVE-2026-1748 is a missing authorization vulnerability in the Invoct – PDF Invoices & Billing for WooCommerce plugin for WordPress. The plugin fails to enforce capability checks on multiple functions, allowing authenticated users with Subscriber-level privileges or above to retrieve sensitive data such as invoice clients, invoice items, and WordPress user email addresses. This issue affects all versions up to and including 1.6. The vulnerability has a CVSS 3.1 score of 4.3, reflecting a medium severity impact primarily on confidentiality. No evidence of active exploitation or vendor patches is currently available.

An attacker with at least Subscriber-level access can access sensitive invoice and user information without proper authorization. This leads to a confidentiality breach of client and user data, including emails. There is no impact on integrity or availability reported. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for unusual access patterns. Avoid granting unnecessary privileges to low-level users. Follow updates from the plugin vendor for any released patches or official mitigations.