CVE-2026-8611 is an authorization bypass vulnerability (CWE-639) in the Klamra Paycal for Aspaclaria WordPress plugin. It allows authenticated users with subscriber-level privileges to exploit an insecure direct object reference via the 'invoice_id' parameter. Due to lack of proper validation, attackers can enumerate sequential post IDs to access arbitrary customer invoices containing sensitive billing PII. This affects all versions up to and including 1.1.4. No official fix or patch has been published as of the vulnerability disclosure date.

An attacker with subscriber-level access can access sensitive billing information of other customers by enumerating invoice IDs. This leads to unauthorized disclosure of personally identifiable information including full names, email addresses, phone numbers, order totals, line items, and customer notes. There is no indication of impact on data integrity or availability. The vulnerability is limited to information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to invoice access. Avoid exposing invoice identifiers in URLs or parameters accessible to lower-privileged users. Implement additional access control checks on the 'invoice_id' parameter if possible.