CVE-2024-13719: Pepro Ultimate Invoice IDOR Vulnerability

CVE-2024-13719 Overview

CVE-2024-13719 is an Insecure Direct Object Reference (IDOR) vulnerability in the PeproDev Ultimate Invoice plugin for WordPress. The flaw affects all versions up to and including 2.0.9. The invoicing viewer accepts a user-controlled key without validating whether the requester should have access to the referenced invoice. Unauthenticated attackers can enumerate the key and retrieve invoices tied to completed orders. These invoices commonly contain personally identifiable information (PII), including customer names, addresses, and purchase details. The vulnerability is tracked under [CWE-862] (Missing Authorization) and [CWE-639] (Authorization Bypass Through User-Controlled Key).

Critical Impact
Unauthenticated attackers can retrieve invoices containing customer PII by manipulating a predictable identifier passed to the invoice viewer.

Affected Products

PeproDev Ultimate Invoice plugin for WordPress, all versions through 2.0.9
WordPress installations with the plugin activated
E-commerce sites relying on the plugin for invoice generation and viewing

Discovery Timeline

2025-02-19 - CVE-2024-13719 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13719

Vulnerability Analysis

The PeproDev Ultimate Invoice plugin exposes an invoice viewer endpoint that accepts a client-supplied key referencing a specific invoice record. The plugin does not verify that the caller is authenticated or that the caller owns the invoice associated with the supplied key. As a result, any anonymous visitor can request invoices belonging to other customers.

Because invoices are generated for completed orders, the exposed records typically contain billing names, physical or email addresses, ordered items, and pricing. Aggregation of this data across many invoices supports downstream fraud, targeted phishing, and identity misuse.

Root Cause

The root cause is missing authorization on the invoice viewer route, combined with reliance on a user-controlled identifier as the sole access control mechanism. This is a textbook Insecure Direct Object Reference pattern. The plugin trusts the key parameter to imply legitimacy rather than checking session state, capability, or ownership against the requested resource. Both [CWE-862] and [CWE-639] apply.

Attack Vector

Exploitation requires only network access to the WordPress site and does not require authentication, user interaction, or elevated privileges. An attacker requests the public invoice viewer URL and substitutes or enumerates the key parameter until a valid invoice is returned. Automated scripts can iterate through candidate values and harvest PII at scale. The impact is limited to confidentiality; the flaw does not alter or destroy data.

No verified proof-of-concept code is published. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-13719

Indicators of Compromise

Sequential or enumerated requests to the plugin's invoice viewer endpoint from a single source IP address
High volumes of anonymous (unauthenticated) HTTP GET requests referencing invoice key or ID parameters
Requests to invoice viewer URLs originating from user agents associated with scraping frameworks or headless browsers
Access log entries showing successful HTTP 200 responses to invoice viewer requests with no prior authenticated session

Detection Strategies

Review WordPress and web server access logs for repeated requests to PeproDev Ultimate Invoice viewer routes with varying key values
Correlate anonymous invoice viewer requests with the same source IP over short time windows to detect enumeration
Alert on unusual bursts of traffic to plugin endpoints that historically receive low volumes
Compare accessed invoice identifiers against expected owner sessions to flag cross-account access

Monitoring Recommendations

Forward WordPress access logs and PHP application logs to a centralized logging or SIEM platform for retention and search
Track the running version of the PeproDev Ultimate Invoice plugin across all WordPress sites in inventory
Monitor Wordfence and WordPress plugin advisories for follow-up disclosures affecting the plugin
Implement web application firewall (WAF) telemetry to observe requests to plugin routes and flag abnormal parameter patterns

How to Mitigate CVE-2024-13719

Immediate Actions Required

Update the PeproDev Ultimate Invoice plugin to a version above 2.0.9 as soon as a patched release is available from the vendor
Audit WordPress access logs for prior anonymous requests to the invoice viewer and identify any PII that may have been exposed
If a patch is not yet applied, deactivate the plugin on production WordPress instances handling customer invoices
Notify affected customers if evidence indicates their invoice data was accessed by unauthorized parties, in line with applicable privacy regulations

Patch Information

The vendor has committed changes to the plugin repository as referenced in the WordPress Plugin Changeset. Administrators should install the latest release published on the Pepro Ultimate Invoice Plugin page and confirm the installed version is greater than 2.0.9.

Workarounds

Restrict access to the invoice viewer endpoint at the web server or WAF layer, allowing only authenticated sessions to reach the route
Deploy WAF rules that rate-limit or block enumeration patterns against the plugin's invoice parameters
Temporarily disable the PeproDev Ultimate Invoice plugin until a patched version is installed
Rotate any predictable invoice identifiers to non-guessable values where the plugin exposes such configuration

bash

# Example: block unauthenticated access to the invoice viewer via .htaccess
# Adjust the path to match the plugin's actual viewer endpoint
<FilesMatch "pepro-ultimate-invoice">
    Require valid-user
</FilesMatch>