CVE-2026-8611: Klamra Paycal WordPress Plugin IDOR Allows Unauthorized Invoice Access

Technical summary

CVE-2026-8611 is an Insecure Direct Object Reference (IDOR) vulnerability in the Klamra Paycal for Aspaclaria WordPress plugin (versions ≤1.1.4). The 'invoice_id' parameter used to retrieve invoice records lacks proper authorization validation, allowing attackers to bypass object-level access controls through sequential enumeration. The plugin fails to verify that the requesting user owns or has legitimate access to the invoice before serving the document. This enables horizontal privilege escalation, where a low-privileged authenticated user can access resources belonging to other users at scale.

Business impact

This vulnerability poses a material privacy and compliance risk. Unauthorized access to customer invoices exposes personally identifiable information (name, email, phone) and financial transaction details. Organizations using this plugin may face GDPR, CCPA, or HIPAA violations depending on jurisdiction and data classification, resulting in regulatory fines, mandatory breach notifications, and reputational harm. The low barrier to exploitation—requiring only subscriber-level access—increases likelihood of insider misuse or compromise of low-privilege accounts. Customers may also suffer identity theft or social engineering attacks using harvested billing information.

Affected systems

The Klamra Paycal for Aspaclaria plugin for WordPress is affected in all versions up to and including 1.1.4. Any WordPress installation with this plugin active and with user registration enabled (allowing subscriber-level accounts) is at risk. The vulnerability is accessible to any authenticated user, including those with minimal permissions, making multiuser WordPress deployments and customer-facing sites particularly vulnerable.

Exploitability

This vulnerability is straightforward to exploit. An attacker with subscriber-level access (obtained through registration or account compromise) can craft requests to the invoice download endpoint, incrementing the invoice_id parameter to enumerate and retrieve invoices belonging to arbitrary customers. No authentication bypass, social engineering, or advanced techniques are required. The attack is reliable, repeatable, and leaves minimal evidence if audit logging is not comprehensive. CVSS 3.1 score of 4.3 (MEDIUM) reflects the requirement for prior authentication, but the low complexity and ease of exploitation warrant immediate attention.

Remediation

Affected organizations should immediately update the Klamra Paycal for Aspaclaria plugin to a version that includes authorization checks on invoice retrieval. Verify the latest patched version against the vendor's advisory. As an interim measure, restrict invoice functionality to administrators only via plugin settings if available, or disable the plugin pending a patch. Additionally, audit access logs for unauthorized invoice downloads and review customer notification procedures in the event of potential exposure.

Patch guidance

Check the official plugin repository and vendor security advisories for a patched release addressing this IDOR vulnerability. Update to the earliest available version after 1.1.4 that includes object-level authorization validation on invoice retrieval. Test the patch in a staging environment before production deployment to confirm functionality is preserved. Verify in the changelog that CWE-639 authorization issues have been remediated.

Detection guidance

Monitor invoice download requests for anomalous patterns: sequential invoice ID enumeration, requests from low-privilege accounts accessing invoices outside their ownership scope, and sudden spikes in invoice API calls. Enable and audit WordPress user activity logs, focusing on plugin interactions and file downloads. Implement Web Application Firewall (WAF) rules to detect repeated failed authorization responses or suspicious parameter manipulation on invoice endpoints. Review access logs for invoice endpoints, comparing user role/capability against accessed resource ownership.

Why prioritize this

Although CVSS 4.3 is rated MEDIUM, this vulnerability warrants higher priority due to: (1) direct exposure of sensitive PII and financial data with no complexity barrier; (2) low friction exploitation requiring only common subscriber access; (3) high likelihood of intentional abuse by insiders or compromised low-privilege accounts; (4) regulatory compliance exposure (GDPR, CCPA, etc.); and (5) potential for rapid, undetected enumeration of customer data at scale. Organizations handling customer payment information should prioritize patching within days, not weeks.

Risk score, explained

CVSS 3.1 assigns 4.3 (MEDIUM) based on: Network-accessible attack vector (AV:N), low attack complexity (AC:L), requirement for low-level authentication (PR:L), no user interaction needed (UI:N), unchanged scope (S:U), and low confidentiality impact (C:L). The score does not account for the volume and sensitivity of exposed data, the practical ease of exploitation, or organizational compliance obligations, all of which elevate business risk above the numeric severity. Organizations should consider local risk context and regulatory environment when setting internal priority.

Frequently asked questions