EUVD-2026-43346Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible WordPress plugin requiring a low-privileged account; confidentiality-only impact with no write or availability consequence confirmed by description.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.13.
AnalysisAI
Missing authorization controls in the Client Invoicing by Sprout Invoices WordPress plugin (versions through 20.8.13) allow low-privileged authenticated users to access confidential invoice data without proper permission checks. The flaw (CWE-862) enables a logged-in WordPress user with minimal privileges to bypass intended access control restrictions and retrieve sensitive financial or client information managed by the plugin. No public exploit or active exploitation has been identified at time of analysis, but the network-accessible attack vector and high confidentiality impact make this a meaningful exposure for sites hosting sensitive invoicing workflows.
Technical ContextAI
CWE-862 (Missing Authorization) describes a failure to verify that a requesting user holds the required permission before granting access to a protected resource or operation. In the WordPress plugin ecosystem, this typically manifests as a REST API endpoint, AJAX handler, or admin action that checks authentication (is the user logged in?) but omits the authorization layer (does this user have permission to perform this action?). The affected product, identified by CPE cpe:2.3:a:boldgrid:client_invoicing_by_sprout_invoices:*:*:*:*:*:*:*:*, is a client-facing invoicing plugin for WordPress developed by BoldGrid under the Sprout Invoices brand. All versions up to and including 20.8.13 are confirmed vulnerable. The CVSS vector (AV:N/PR:L) confirms the flaw is reachable over the network by any authenticated WordPress user, regardless of their assigned role.
RemediationAI
The primary remediation is to update the Client Invoicing by Sprout Invoices plugin to a version beyond 20.8.13 via the WordPress admin dashboard or WP-CLI. A specific patched version number was not independently confirmed in the available data; consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/sprout-invoices/vulnerability/wordpress-client-invoicing-by-sprout-invoices-plugin-20-8-13-broken-access-control-vulnerability for the confirmed fix version. If an immediate update is not possible, a practical compensating control is to disable open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register'), which removes the ability for untrusted parties to obtain the low-privileged account required for exploitation - note this may affect legitimate self-service flows. Additionally, a web application firewall rule blocking unauthorized access to the plugin's AJAX or REST endpoints can reduce exposure, though the specific vulnerable endpoints are not enumerated in available data. Deactivating the plugin entirely eliminates the attack surface until patching is feasible.
The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings
Sprout Invoices Client Invoicing versions 20.8.9 and earlier contain a local file inclusion vulnerability in PHP that al
BoldGrid Client Invoicing by Sprout Invoices versions 20.8.10 and earlier fails to enforce authorization controls, allow
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today