CVE-2020-20625: 
WordPress vulnerability analysis and mitigation

The Sliced Invoices plugin for WordPress version 3.8.2 and earlier contained multiple security vulnerabilities. The plugin, which had over 6,000 active installations at the time, was discovered to be susceptible to unauthenticated information disclosure and authenticated SQL injection vulnerabilities via core/class-sliced.php. The vulnerability was discovered on October 8, 2019, and publicly disclosed on October 17, 2019 (NinTechNet Blog).

The vulnerability stems from multiple security issues in the plugin's core functionality. The export_csv_full function in core/class-sliced.php lacked proper capability checks and security nonces. Additionally, the duplicate_quote_invoice function contained an SQL injection vulnerability due to unsanitized input from the $_GET['post'] parameter. The CVSS v3.1 base score is 7.5 (HIGH) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerabilities could allow attackers to export all invoices and quotes containing sensitive customer information including names, home addresses, and email addresses without authentication. Additionally, authenticated attackers could exploit the SQL injection vulnerability and duplicate all posts and pages, potentially exposing private or draft content to the public (NinTechNet Blog).

The vulnerability was relatively easy to exploit due to the lack of basic security controls. The information disclosure vulnerability required no authentication, while the SQL injection vulnerability required only an authenticated user account. The vulnerability was publicly disclosed with proof-of-concept details (NinTechNet Blog).

Users were advised to update their installations immediately if running version 3.8.2 or below. Users of NinjaFirewall WP Edition (free) and NinjaFirewall WP+ Edition (premium) were automatically protected against these vulnerabilities (NinTechNet Blog).