CVE-2026-2343

Publication date

2026-03-25 06:00:02

Family

WPScan

State

PUBLISHED

Description

The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII.