This vulnerability (CVE-2026-27372) affects PeproDev Ultimate Invoice versions up to 2.2.6 and involves unauthenticated exposure of sensitive data due to CWE-201 (Insertion of Sensitive Information Into Sent Data). The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact. No official fix or patch has been documented, and no known exploits are reported in the wild.

An unauthenticated attacker can cause sensitive information to be exposed, potentially compromising confidentiality. There is no impact on integrity or availability reported. The vulnerability could lead to leakage of sensitive data without requiring authentication, which may affect data privacy and security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected application and minimizing exposure to untrusted networks where feasible.