CVE-2024-30517: Sliced Invoices Auth Bypass Vulnerability

CVE-2024-30517 Overview

CVE-2024-30517 is a Missing Authorization vulnerability [CWE-862] in the Sliced Invoices WordPress plugin developed by slicedinvoices. The flaw affects all versions from unspecified initial releases through 3.9.2. The plugin fails to enforce proper authorization checks on sensitive operations, allowing authenticated attackers with low privileges to access or manipulate resources beyond their intended scope. The issue is classified as Broken Access Control and impacts WordPress sites running the vulnerable plugin.

Critical Impact
Authenticated attackers with low privileges can bypass authorization controls to access, modify, or destroy invoice data and related resources across the WordPress site.

Affected Products

Sliced Invoices WordPress plugin versions up to and including 3.9.2
WordPress sites with the sliced-invoices plugin activated
Any downstream deployments bundling Sliced Invoices <= 3.9.2

Discovery Timeline

2024-06-09 - CVE-2024-30517 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30517

Vulnerability Analysis

The Sliced Invoices plugin exposes actions that do not verify whether the requesting user holds the required capability or role. The plugin relies on user authentication alone rather than performing granular capability checks on privileged endpoints. Authenticated users with minimal roles, such as Subscriber or Customer, can invoke functions intended for administrators or invoice managers. The result is a full compromise of the confidentiality, integrity, and availability of invoice records and adjacent plugin data.

Root Cause

The root cause is a missing authorization check [CWE-862] on one or more plugin request handlers. The code path validates that a session is authenticated but does not call current_user_can() or an equivalent capability guard before executing sensitive operations. This gap allows low-privileged accounts to reach code intended for privileged roles.

Attack Vector

Exploitation occurs over the network against the WordPress site. An attacker first obtains a low-privileged account, which is trivial on sites permitting open registration or customer signup. The attacker then issues crafted HTTP requests to the affected plugin endpoints. No user interaction is required beyond the attacker's own session. Refer to the Patchstack Vulnerability Report for endpoint-level technical details.

Detection Methods for CVE-2024-30517

Indicators of Compromise

Unexpected HTTP POST or GET requests to sliced-invoices plugin endpoints originating from low-privileged user sessions
Creation, modification, or deletion of invoice records that do not correlate with administrator activity
New or altered invoice records lacking a corresponding audit trail in the WordPress admin logs

Detection Strategies

Review WordPress access logs for requests to plugin actions containing sliced_ or sliced-invoices parameters from non-administrative accounts
Correlate authenticated user IDs against the WordPress wp_usermeta role assignments to identify privilege mismatches
Alert on anomalous invoice CRUD operations performed by accounts that do not hold invoice-management capabilities

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward events to a centralized logging platform for correlation
Monitor plugin file integrity and database changes to detect unauthorized invoice manipulation
Track user registration spikes that may precede exploitation attempts against the plugin

How to Mitigate CVE-2024-30517

Immediate Actions Required

Upgrade the Sliced Invoices plugin to a version later than 3.9.2 as soon as a fixed release is available from the vendor
Audit all WordPress accounts and remove unused or unrecognized low-privileged users
Disable open user registration on sites that do not require it, reducing the pool of accounts that can reach the vulnerable endpoints

Patch Information

Consult the vendor's plugin repository and the Patchstack Vulnerability Report for the latest patched version and remediation guidance. Apply the fixed version through the WordPress plugin manager or WP-CLI once released.

Workarounds

Deactivate the Sliced Invoices plugin until an updated version is installed if the plugin is not business-critical
Restrict access to /wp-admin/admin-ajax.php and plugin endpoints using a web application firewall rule that blocks non-administrative sessions
Enforce least-privilege role assignments and remove invoice-related capabilities from default subscriber and customer roles

bash

# Disable the plugin via WP-CLI until a patched release is applied
wp plugin deactivate sliced-invoices

# Verify installed plugin version
wp plugin get sliced-invoices --field=version