CVE-2023-2180: Kiwiz Invoices Certification & PDF System Project Kiwiz Invoices Certification & PDF System

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization (assuming they can upload a file on the server)

Affected products

• Kiwiz Invoices Certification & PDF System Project Kiwiz Invoices Certification & PDF System: up to and including 2.1.3

Published 2023-05-15. Last modified 2026-06-17.