CVE-2026-9021: Easy Invoice WordPress Auth Bypass Flaw

CVE-2026-9021 Overview

CVE-2026-9021 is a Missing Authorization vulnerability [CWE-862] affecting the Easy Invoice plugin for WordPress in versions up to and including 2.1.19. The plugin registers the easy_invoice_accept_quote and easy_invoice_decline_quote AJAX actions through wp_ajax_nopriv_ hooks. Access control relies solely on a quote-scoped nonce that is rendered into the publicly accessible single quote template. An ownership check exists but is gated behind an off-by-default Pro option (easy_invoice_pro_restrict_quote_to_client). Unauthenticated attackers can harvest the per-quote nonce from the public quote page and submit it to admin-ajax.php to accept or decline arbitrary published quotes.

Critical Impact
Unauthenticated attackers can accept or decline any published quote, potentially triggering automatic invoice generation and client email delivery, disrupting business workflows.

Affected Products

WordPress Easy Invoice plugin versions up to and including 2.1.19
WordPress sites with the plugin's Pro client-restriction option disabled (default configuration)
Sites configured to auto-convert accepted quotes into invoices

Discovery Timeline

2026-07-09 - CVE-2026-9021 published to the National Vulnerability Database
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-9021

Vulnerability Analysis

The vulnerability resides in the QuoteController.php file of the Easy Invoice plugin. The controller registers accept and decline AJAX handlers using the wp_ajax_nopriv_ hook prefix, which explicitly exposes those endpoints to unauthenticated visitors. The only protective control is a WordPress nonce scoped to a specific quote identifier. Because that nonce is rendered directly into the public single quote template at templates/quotes/single.php, any visitor who can view the quote page can extract it. The plugin's ownership check, which would restrict actions to the intended client, is contained inside the easy_invoice_pro_restrict_quote_to_client Pro option and is disabled by default.

Root Cause

The root cause is the conflation of a nonce with an authorization check. Nonces in WordPress are designed to prevent cross-site request forgery, not to authenticate or authorize users [CWE-862]. Rendering the nonce into a publicly accessible template while omitting a capability or ownership check leaves the endpoint effectively unauthenticated.

Attack Vector

An unauthenticated remote attacker retrieves a published quote page over HTTPS and parses the embedded per-quote nonce from the response. The attacker then issues a POST request to admin-ajax.php with the action parameter set to easy_invoice_accept_quote or easy_invoice_decline_quote, supplying the harvested nonce and quote identifier. Depending on the site's configured accept action, the request can automatically convert the quote into an invoice and email the resulting document to the client on record.

No verified proof-of-concept code is published. Refer to the Wordfence Vulnerability Reference and the WordPress Easy Invoice Change Set for authoritative technical details.

Detection Methods for CVE-2026-9021

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=easy_invoice_accept_quote or action=easy_invoice_decline_quote originating from unauthenticated sessions.
Quotes transitioning to accepted or declined state without a matching authenticated user session in WordPress access logs.
Unexpected invoice creation events or outbound client emails immediately following requests to public quote URLs.
Repeated GETs to /?p=<quote_id> or the single quote permalink followed by AJAX submissions from the same source IP.

Detection Strategies

Correlate WordPress access logs to flag admin-ajax.php calls invoking the two vulnerable actions without an authenticated wordpress_logged_in_* cookie.
Alert on invoice objects created within seconds of a public quote page view from the same client IP or user agent.
Baseline normal quote-acceptance volume per site and trigger on statistically anomalous spikes.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform for query-based hunts across HTTP method, action name, and authentication state.
Enable audit logging inside the Easy Invoice plugin, if available, and retain quote state-change events for at least 90 days.
Monitor outbound SMTP traffic for invoice-related emails that lack a corresponding authenticated administrative action.

How to Mitigate CVE-2026-9021

Immediate Actions Required

Update the Easy Invoice plugin to a version newer than 2.1.19 that includes the fix referenced in the WordPress Easy Invoice Change Set.
Audit recently created invoices and quote state changes to identify unauthorized acceptances or declines.
Temporarily disable the Easy Invoice plugin on sites that cannot be patched immediately.

Patch Information

The vendor addressed the issue in the Easy Invoice plugin trunk via changeset 3517910. Site administrators should upgrade to the latest version distributed through the WordPress plugin repository. Review the WordPress Easy Invoice Code reference for the fixed controller logic.

Workarounds

Enable the easy_invoice_pro_restrict_quote_to_client Pro option to enforce ownership checks on accept and decline actions.
Restrict access to quote permalinks using authenticated-only membership rules or IP allowlists at the web server or WAF layer.
Block anonymous POST requests to admin-ajax.php that carry the easy_invoice_accept_quote or easy_invoice_decline_quote action parameters until patching is complete.

bash

# Example nginx rule to block the vulnerable AJAX actions pending patch
location = /wp-admin/admin-ajax.php {
    if ($request_method = POST) {
        if ($args ~* "action=easy_invoice_(accept|decline)_quote") {
            return 403;
        }
    }
}