CVE-2026-9021 is a missing authorization vulnerability (CWE-862) in the Easy Invoice – Invoice Generator, PDF Quotes & Payments WordPress plugin by matrixaddons. The plugin registers AJAX actions (easy_invoice_accept_quote and easy_invoice_decline_quote) via wp_ajax_nopriv_ hooks, allowing unauthenticated access. It relies solely on a quote-scoped nonce rendered in the public quote template and an ownership check gated behind an off-by-default Pro option (easy_invoice_pro_restrict_quote_to_client). This enables attackers to harvest the nonce from public pages and submit requests to accept or decline arbitrary quotes, potentially converting them into invoices and emailing clients without authorization.

An unauthenticated attacker can accept or decline arbitrary published quotes, leading to unauthorized invoice creation and emailing. This compromises the integrity of the invoicing process but does not impact confidentiality or availability. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, no user interaction, and impact limited to integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the affected AJAX actions or enabling the Pro option 'easy_invoice_pro_restrict_quote_to_client' if available and applicable to enforce ownership checks. Monitor vendor channels for updates and apply patches promptly once released.