Exploitation Research Plan - CVE-2026-48836 (Easy Invoice RCE)

1. Vulnerability Summary

The Easy Invoice plugin for WordPress (<= 2.1.19) is vulnerable to **Unauthenticated Remote Code Execution** due to improper control of code generation during PDF document creation. The plugin registers unauthenticated AJAX handlers (nopriv_easy_invoice_generate_pdf) that process user-supplied HTML or template data. If the underlying PDF library (likely dompdf) is configured with PHP execution enabled (isPhpEnabled => true), an attacker can inject and execute arbitrary PHP code on the server.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: easy_invoice_generate_pdf or easy_invoice_generate_quote_pdf
• Authentication: None (Unauthenticated via nopriv hook)
• Preconditions: The plugin must be active. A valid Quote or Invoice ID may be required if the handler validates existence, though the vulnerability likely resides in the processing of arbitrary html or data parameters sent to the PDF engine.

3. Code Flow

1. Registration: includes/Admin/EasyInvoiceAjax.php registers the AJAX actions:

   add_action('wp_ajax_nopriv_easy_invoice_generate_pdf', array($this, 'generateInvoicePdf'));
   add_