CVE-2020-20625
WordPress vulnerability analysis and mitigation

Overview

The Sliced Invoices plugin for WordPress version 3.8.2 and earlier contained multiple security vulnerabilities. The plugin, which had over 6,000 active installations at the time, was discovered to be susceptible to unauthenticated information disclosure and authenticated SQL injection vulnerabilities via core/class-sliced.php. The vulnerability was discovered on October 8, 2019, and publicly disclosed on October 17, 2019 (NinTechNet Blog).

Technical details

The vulnerability stems from multiple security issues in the plugin's core functionality. The export_csv_full function in core/class-sliced.php lacked proper capability checks and security nonces. Additionally, the duplicate_quote_invoice function contained an SQL injection vulnerability due to unsanitized input from the $_GET['post'] parameter. The CVSS v3.1 base score is 7.5 (HIGH) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

Impact

The vulnerabilities could allow attackers to export all invoices and quotes containing sensitive customer information including names, home addresses, and email addresses without authentication. Additionally, authenticated attackers could exploit the SQL injection vulnerability and duplicate all posts and pages, potentially exposing private or draft content to the public (NinTechNet Blog).

Exploitability

The vulnerability was relatively easy to exploit due to the lack of basic security controls. The information disclosure vulnerability required no authentication, while the SQL injection vulnerability required only an authenticated user account. The vulnerability was publicly disclosed with proof-of-concept details (NinTechNet Blog).

Mitigation and workarounds

Users were advised to update their installations immediately if running version 3.8.2 or below. Users of NinjaFirewall WP Edition (free) and NinjaFirewall WP+ Edition (premium) were automatically protected against these vulnerabilities (NinTechNet Blog).

Additional resources


SourceThis report was generated using AI

Related WordPress vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-83547MEDIUM6.8
  • xpro-elementor-addons
NoYesSep 02, 2026
CVE-2026-82884MEDIUM6.8
  • all-in-one-seo-pack
NoYesSep 02, 2026
CVE-2026-8151MEDIUM5.4
  • simple-membership-mailchimp-integration
NoYesSep 02, 2026
CVE-2026-83533MEDIUM5.3
  • wp-express-checkout
NoYesSep 02, 2026
CVE-2026-81571MEDIUM4.8
  • brave-popup-builder
NoYesSep 02, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management