CVE-2026-9857 Overview
CVE-2026-9857 is an authorization bypass vulnerability in the Invoice123 (saskaita123-lt) plugin for WordPress. The flaw affects all versions up to and including 1.7.0. The plugin fails to verify that a user is authorized to perform sensitive actions on administrative endpoints. Authenticated attackers with subscriber-level access or higher can overwrite the plugin's API key stored in wp_options, modify invoice plugin settings, and alter WooCommerce tax rate data in the wp_woocommerce_tax_rates table. The vulnerability is classified as Missing Authorization under [CWE-862].
Critical Impact
Low-privileged authenticated users can tamper with WooCommerce tax rates and hijack the plugin's API key, enabling financial data manipulation and integration abuse.
Affected Products
- Invoice123 (saskaita123-lt) WordPress plugin versions ≤ 1.6.8
- Invoice123 (saskaita123-lt) WordPress plugin version 1.7.0
- WordPress sites running WooCommerce alongside vulnerable Invoice123 versions
Discovery Timeline
- 2026-07-10 - CVE-2026-9857 published to NVD
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-9857
Vulnerability Analysis
The Invoice123 plugin exposes administrative pages that handle API key configuration and invoice settings without enforcing capability checks. The vulnerable code paths reside in includes/pages/S123_ApiKey.php and includes/pages/S123_InvoiceSettings.php. Because these handlers are reachable by any authenticated WordPress user, subscribers can invoke privileged operations reserved for administrators.
Successful exploitation allows an attacker to overwrite the API key persisted in the wp_options table, adjust invoice generation settings, and manipulate tax rate rows in the wp_woocommerce_tax_rates table. Tampering with tax rates directly impacts financial calculations on WooCommerce storefronts.
Root Cause
The root cause is missing authorization enforcement on plugin action handlers. The handlers do not call current_user_can() with an appropriate capability such as manage_options before writing to wp_options or the WooCommerce tax rate table. Nonce validation alone, if present, does not substitute for capability checks. See the WordPress Plugin Code Snippet for S123_ApiKey.php and S123_InvoiceSettings.php for the affected handlers.
Attack Vector
An attacker first obtains any authenticated account with subscriber privileges or higher. Registration is often open on WordPress sites, lowering this barrier. The attacker then submits a crafted POST request to the plugin's admin-post or admin-ajax endpoint that triggers the settings update handler. Because the handler does not verify capabilities, the request succeeds and persists attacker-controlled values into the database. Refer to the Wordfence Vulnerability Report and the WordPress Changeset Record for the remediation diff.
No verified public exploit code is available. The EPSS probability is 0.288% at the 20.82 percentile.
Detection Methods for CVE-2026-9857
Indicators of Compromise
- Unexpected modifications to rows in the wp_woocommerce_tax_rates table without a corresponding administrator session in access logs.
- Changes to the Invoice123 API key value in wp_options that were not initiated by an administrator.
- POST requests to admin-post.php or admin-ajax.php targeting Invoice123 handlers originating from subscriber-level accounts.
Detection Strategies
- Audit WordPress access logs for POST requests referencing S123_ApiKey or S123_InvoiceSettings from non-administrator user IDs.
- Enable database change auditing on wp_options entries prefixed with the Invoice123 option keys and on the wp_woocommerce_tax_rates table.
- Compare current plugin option values and tax rate rows against known-good baselines on a scheduled cadence.
Monitoring Recommendations
- Alert on newly registered subscriber accounts that immediately issue POST requests to plugin admin endpoints.
- Monitor for outbound traffic to unexpected invoicing API destinations, which may indicate a swapped API key.
- Track WooCommerce tax configuration changes and correlate them with the acting user's assigned role.
How to Mitigate CVE-2026-9857
Immediate Actions Required
- Update the Invoice123 (saskaita123-lt) plugin to a version later than 1.7.0 once the vendor publishes a patched release.
- Rotate the Invoice123 API key and any credentials that may have been exposed through wp_options tampering.
- Review wp_woocommerce_tax_rates for unauthorized modifications and restore accurate values from backups.
- Restrict user registration to trusted workflows and audit existing subscriber-level accounts.
Patch Information
The vulnerability is present through version 1.7.0. Site operators should apply the vendor's fixed release once available. The remediation commit is tracked in the WordPress Changeset Record.
Workarounds
- Deactivate the Invoice123 plugin until a patched version is installed.
- Deploy a Web Application Firewall (WAF) rule that blocks requests to Invoice123 admin handlers from users lacking the manage_options capability.
- Temporarily disable open user registration via the WordPress setting Anyone can register under Settings → General.
# Configuration example: disable the plugin via WP-CLI until a fix is released
wp plugin deactivate saskaita123-lt
wp option get users_can_register
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
