CVE-2025-31628 Overview
CVE-2025-31628 is a Missing Authorization vulnerability [CWE-862] affecting the Sliced Invoices WordPress plugin developed by SlicedInvoices. The flaw exists in all versions up to and including 3.10.0. Attackers exploit incorrectly configured access control security levels to reach functionality that should require authentication or higher privileges. The vulnerability is exploitable remotely over the network without user interaction or prior authentication. Successful exploitation results in unauthorized disclosure of information handled by the plugin, including invoice and quote data.
Critical Impact
Unauthenticated remote attackers can access plugin functionality and disclose confidential invoicing data due to broken access control on plugin endpoints.
Affected Products
- SlicedInvoices Sliced Invoices WordPress plugin
- All versions from n/a through 3.10.0
- WordPress sites using the sliced-invoices plugin
Discovery Timeline
- 2025-04-01 - CVE-2025-31628 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-31628
Vulnerability Analysis
The Sliced Invoices plugin fails to enforce authorization checks on one or more of its accessible endpoints. Access control decisions are either missing entirely or configured at an incorrect security level. This allows requests to reach protected functionality without the caller proving sufficient privilege. The result is a confidentiality impact against invoice, quote, and client data stored by the plugin.
The vulnerability class, tracked as CWE-862, occurs when a product does not perform an authorization check when an actor attempts to access a resource or perform an action. Integrity and availability are not directly affected according to the CVSS vector, but exposed data may include billing details, customer identifiers, and financial records.
Root Cause
The root cause is an incorrectly configured capability or nonce check within the plugin's request handling logic. WordPress plugins typically gate privileged actions using current_user_can(), is_user_logged_in(), or check_ajax_referer(). When these checks are absent, applied to the wrong capability, or bypassed on public-facing AJAX or REST routes, unauthenticated callers can invoke plugin operations directly.
Attack Vector
An attacker sends crafted HTTP requests to the vulnerable plugin endpoint on a target WordPress site. No credentials, tokens, or user interaction are required. The request reaches plugin logic that returns or acts on data without validating the caller's identity or role. Automated scanning against WordPress sites running sliced-invoices ≤ 3.10.0 makes discovery trivial.
Refer to the Patchstack Security Vulnerability Report for endpoint-level technical details.
Detection Methods for CVE-2025-31628
Indicators of Compromise
- Unauthenticated HTTP requests to admin-ajax.php or REST endpoints containing sliced or sliced_invoices action parameters.
- Anomalous outbound responses from WordPress sites containing invoice, quote, or client PII payloads to unfamiliar IP addresses.
- Access log entries showing repeated requests to plugin routes from a single source without prior authenticated session cookies.
Detection Strategies
- Inventory WordPress deployments and flag any installation with the sliced-invoices plugin at version 3.10.0 or earlier.
- Deploy web application firewall rules that require an authenticated WordPress session cookie for requests targeting Sliced Invoices AJAX actions.
- Correlate WordPress access logs with authentication events to identify unauthenticated calls that returned non-empty JSON payloads.
Monitoring Recommendations
- Alert on HTTP 200 responses to plugin endpoints when the request lacks wordpress_logged_in_* cookies.
- Monitor for enumeration patterns where sequential invoice or quote IDs are queried from the same source.
- Track plugin version drift across managed WordPress fleets and escalate when vulnerable versions reappear.
How to Mitigate CVE-2025-31628
Immediate Actions Required
- Update the Sliced Invoices plugin to the version released after 3.10.0 that addresses the missing authorization check.
- If a patched release is unavailable, deactivate and remove the sliced-invoices plugin from all WordPress instances.
- Audit recent web server logs for unauthenticated requests to plugin endpoints and review invoice data for unauthorized access.
Patch Information
The vulnerability affects Sliced Invoices versions through 3.10.0. Site administrators should upgrade to the latest version published by SlicedInvoices that resolves the broken access control issue. Confirm remediation by reviewing the Patchstack advisory.
Workarounds
- Restrict access to /wp-admin/admin-ajax.php actions associated with Sliced Invoices via web application firewall rules until the plugin is patched.
- Place the WordPress admin area behind IP allow-listing or an authenticating reverse proxy to limit exposure.
- Disable the plugin on any site where invoicing functionality is not actively required.
# Example WAF rule to block unauthenticated Sliced Invoices AJAX calls
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
"chain,deny,status:403,id:1003162801,msg:'Block unauth Sliced Invoices access'"
SecRule ARGS:action "@rx ^sliced_" "chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
