CVE-2026-27372 MEDIUM

CVE-2026-27372: WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

Vendor Pepro Dev. Group

Product PeproDev Ultimate Invoice

Weakness CWE-201

Published July 23, 2026

Last update July 23, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.

Explanation of Vulnerability in Simple Terms

02Summary

PeproDev Ultimate Invoice versions up to 2.2.6 expose sensitive information to unauthenticated users. An attacker can view confidential data by crafting a malicious link and tricking a user into clicking it. The vulnerability requires user interaction but does not require authentication. Update to a version newer than 2.2.6.

What an attacker can do

03Attacker Capabilities

View sensitive information from the invoice system without authentication.

Potential impact on your site

04Site Impact

Confidential invoice data and business information may be exposed to unauthorized parties.

Conditions required to exploit

05Prerequisites

Victim must click a malicious link; attacker has network access.

Key dates

06Disclosure timeline

July 23, 2026 CVE published

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-27372 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/201.html AskarLabs — CWE-201 write-up Insertion of Sensitive Information Into Sent Data

Related vulnerabilities

Identifiers

CVE CVE-2026-27372

CWE CWE-201

CVSS 6.5 / MEDIUM

Affected versions