What is the CVSS score of CVE-2025-64227?

CVE-2025-64227 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Sprout Invoices are affected by CVE-2025-64227?

Client Invoicing by Sprout Invoices (sprout-invoices) creates a potential unauthenticated code-execution and data-compromise path on WordPress sites running versions up to and including 20.8.7, and…

How to fix or mitigate CVE-2025-64227?

Within 24 hours, inventory all WordPress sites for Client Invoicing by Sprout Invoices (sprout-invoices) versions up to and including 20.8.7, and if the plugin is not business-critical, deactivate and remove it; if it must remain, place affected sites behind a WAF or reverse proxy with virtual patching that blocks crafted serialized input to sprout-invoices endpoints, restrict administrative access, and enable logging and alerting for object-injection or exploitation attempts. Within 7 days, apply vendor- or WAF-supplied virtual patching rules, review other active plugins and themes for known PHP object injection gadget chains, remove unused plugins and themes, enforce least privilege and MFA for WordPress administrators, and conduct a compromise assessment of access logs, user accounts, scheduled tasks, and file integrity for affected sites. Within 30 days, continue tracking vendor advisories for a fixed version of sprout-invoices above 20.8.7 and test and deploy it as soon as released; if no patch is forthcoming, migrate to a supported invoicing plugin or isolate the application, and complete a security review with daily monitoring and an incident-response playbook for potential code execution or invoicing data exposure. No vendor-released patch identified at time of analysis.

Sprout Invoices CVE-2025-64227

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-12-18 audit@patchstack.com

PHP WordPress Deserialization Wordpress Plugin

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Remote unauthenticated (AV:N/PR:N/UI:N), but full impact realistically depends on a reachable POP gadget chain, so AC:H rather than AC:L; full CIA if chain exists.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 26, 2026 - 00:40 vuln.today

tag: PHP added

Analysis Generated

Sep 25, 2026 - 23:45 vuln.today

CVE Published

Dec 18, 2025 - 08:16 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.

AnalysisAI

Unauthenticated PHP object injection in the WordPress plugin Client Invoicing by Sprout Invoices (sprout-invoices) up to and including version 20.8.7 lets remote attackers pass crafted serialized data into an unserialize() sink, which can trigger arbitrary object instantiation and, if a suitable POP gadget chain is loaded, full code execution or data compromise. The plugin's NVD/Patchstack vector is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), while our independent assessment scores it 9.8 with a higher attack complexity (AC:H) because real-world impact hinges on a usable gadget chain being present in the plugin, WordPress core, or another active plugin. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.38% (29th percentile), so exploitation is currently assessed as plausible but not observed.

Technical ContextAI

The flaw is a classic CWE-502 Deserialization of Untrusted Data issue in a PHP WordPress plugin. Sprout Invoices accepts attacker-influenced input that is routed to PHP's unserialize() without adequate validation, allowing an attacker to control the object graph that PHP reconstructs. Because PHP instantiates attacker-named classes during unserialization and automatically invokes magic methods such as __wakeup(), __destruct(), and __toString(), a suitably crafted payload can drive a property-oriented programming (POP) gadget chain that chains method calls across loaded classes to reach dangerous sinks like file writes, SQL execution, or command execution. The practical ceiling of the bug is therefore environment-dependent: an object-injection primitive alone is not guaranteed code execution, and the exploitability varies with which classes are autoloadable at runtime (the plugin itself, WordPress core, or other installed plugins/themes). The advisory is attributed to Patchstack and maps to the WordPress plugin ecosystem; no CPE strings were supplied, but the affected component is unambiguously the Client Invoicing by Sprout Invoices plugin for WordPress at version 20.8.7 and earlier, and the CVSS vector (AV:N/PR:N/UI:N) indicates the vulnerable path is reachable remotely without credentials or user interaction.

Affected ProductsAI

Client Invoicing by Sprout Invoices (WordPress plugin slug sprout-invoices), all versions up to and including 20.8.7, per the vendor-neutral advisory at https://patchstack.com/database/Wordpress/Plugin/sprout-invoices/vulnerability/wordpress-client-invoicing-by-sprout-invoices-plugin-20-8-7-php-object-injection-vulnerability. No CPE identifiers were provided in the source data, so exact CPE matching is unavailable; the affected surface is any WordPress installation with the plugin installed and active, and no non-default configuration is documented as a prerequisite for reaching the vulnerable unserialize() code path.

RemediationAI

No vendor-released patch or fixed version was identified at time of analysis in the provided data, so the immediate action is to treat the plugin as vulnerable and remove the attack surface: deactivate and uninstall Client Invoicing by Sprout Invoices if it is not business-critical, accepting the loss of invoicing functionality, or isolate it behind strict access controls if it must remain. If the plugin stays installed, place a WAF or reverse-proxy rule in front of the site that inspects request bodies for PHP serialization markers (for example O: object tokens and serialized class names) targeting plugin endpoints, understanding that signature-based blocking can be evaded with encoding tricks and may generate false positives on legitimate traffic. Because exploitability depends on a usable gadget chain, additionally reduce the loaded class surface by removing unnecessary plugins and themes, which shrinks the population of POP gadgets but does not fix the underlying flaw. Monitor the Patchstack advisory page for a patched release and apply it as soon as one is published, and treat any successful object-injection attempt as a potential full site compromise requiring credential rotation and malware review rather than a limited plugin-only incident.