Client Invoicing By Sprout Invoices CVE-2026-39562

The vulnerability is exploitable against any WordPress installation running Client Invoicing by Sprout Invoices version 20.8.10 or earlier with the plugin enabled and activated. No special WordPress configuration or feature enablement is required; standard WordPress installation with the vulnerable plugin is sufficient. The missing authorization checks apply to one or more plugin endpoints that are accessible over the network, meaning the plugin's functions or AJAX handlers do not validate user capabilities before performing sensitive operations. The vulnerability does not require authentication (PR:N in CVSS vector confirms this), so any network-accessible WordPress instance with the vulnerable plugin presents an attack surface.

The CVSS 5.3 (Medium) score reflects AV:N/AC:L/PR:N/UI:N (remote, low complexity, no authentication required, no user interaction), which normally signals serious risk. However, the EPSS score of 0.02% (4th percentile) provides critical context: despite theoretical exploitability, real-world exploitation probability is negligible. This disconnect suggests the vulnerability requires specific knowledge of internal plugin endpoints, is difficult to chain into meaningful impact, or affects configurations rarely deployed in practice. The impact is limited to integrity (I:L) with no confidentiality or availability impact, meaning data modification rather than data theft or service disruption. The lack of public POC code and absence of any KEV/active exploitation documentation further reduce immediate risk. For organizations running this plugin, this is a low-priority patch-review and test before applying to avoid breaking changes, but deferring patching poses minimal operational risk.

An attacker without WordPress credentials identifies the vulnerable plugin by examining HTTP response headers or plugin enumeration techniques, then crafts a direct HTTP request to an unprotected invoicing endpoint (such as one for modifying client information or marking invoices as paid). Because the plugin fails to validate authorization, the request succeeds and modifies invoice data. In a real scenario, this could allow competitors to mark invoices as paid, redirect payment records, or alter client data without detection.