CVE-2026-9021: Easy Invoice <= 2.1.19 - Unauthenticated Arbitrary Quote Accept/Decline and Invoice Creation via easy_invoice_accept_quote / easy_invoice_decline_quote AJAX Actions
The Easy Invoice plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.19. This is due to the plugin registering the easyinvoiceacceptquote and easyinvoicedeclinequote AJAX actions via wpajaxnopriv hooks and relying solely on a quote-scoped nonce that is rendered into the publicly accessible single quote template, combined with an ownership check that is gated behind an off-by-default Pro option (easyinvoiceprorestrictquotetoclient). This makes it possible for unauthenticated attackers to accept or decline arbitrary published quotes — and, depending on the configured accept action, automatically convert them into invoices (and even email them to the client) — by harvesting the per-quote nonce from the public quote page and submitting it to admin-ajax.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Easy Invoice pluginto a version that resolves this vulnerability.Fixed in 2.1.19 - Compensating control
If using the Pro feature easy_invoice_pro_restrict_quote_to_client, ensure it is enabled to gate the quote ownership check (the ownership check is described as gated behind an off-by-default Pro option).
- Compensating control
Block unauthenticated access to the WordPress admin-ajax endpoint for the affected AJAX actions easy_invoice_accept_quote and easy_invoice_decline_quote (e.g., via WAF/ACL/rules), since the vulnerability exists because the actions are registered via wp_ajax_nopriv_.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9021?
The severity of CVE-2026-9021 is medium with a score of 5.3.
How do I fix CVE-2026-9021?
To fix CVE-2026-9021, update the Easy Invoice plugin to version 2.2.0 or later.
What types of actions are affected by CVE-2026-9021?
CVE-2026-9021 affects the easy_invoice_accept_quote and easy_invoice_decline_quote AJAX actions.
What is the impact of CVE-2026-9021?
The impact of CVE-2026-9021 is the potential for unauthenticated users to accept or decline quotes and create invoices.
Who is affected by CVE-2026-9021?
Users of the Easy Invoice plugin for WordPress versions up to and including 2.1.19 are affected by CVE-2026-9021.