Client Invoicing By Sprout Invoices CVE-2026-39562

This is a missing authorization vulnerability (CWE-862) in a WordPress plugin, which typically means the application performs actions or returns data without verifying whether the user has permission to perform those actions. The vulnerability operates at the access control layer rather than through cryptographic or encoding failures. The Sprout Invoices plugin provides invoicing functionality within WordPress; the broken access control suggests that certain API endpoints or functions that modify invoice data or client information do not properly validate user roles or capabilities before executing sensitive operations. WordPress plugins typically define capabilities and roles through the wp_user_can() function or role-based checks; this plugin appears to be missing such validation on one or more endpoints, potentially allowing any network user to invoke privileged actions.