CVE-2016-11011: The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.

Security readout for executives and security teams

CVE-2016-11011 concerns a privilege escalation flaw in the WordPress wp-invoice plugin before version 4.1.1. If a site runs a vulnerable plugin version, an attacker may be able to misuse the wpi_update_user_option functionality to gain higher privileges. The source bundle does not provide CVSS scoring or confirmed exploitation evidence. Exposure appears limited to WordPress sites with the wp-invoice plugin installed below version 4.1.1. The provided sources do not identify specific affected roles, configuration requirements, or whether exploitation requires an account. Prioritize remediation where wp-invoice is present on public or revenue-impacting WordPress sites. Business risk depends on whether vulnerable versions remain deployed and whether attackers can reach the affected functionality; the provided sources do not quantify likelihood. Mitigation focus: Inventory WordPress sites for the wp-invoice plugin and record installed versions.; Update wp-invoice to 4.1.1 or later where vendor guidance confirms availability.; If updating is not possible, disable or remove the plugin pending vendor guidance..

Prepared

Jun 6, 2026, 13:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.