Sprout Invoices CVE-2026-57418

Exploitation requires a valid WordPress user account with at minimum subscriber-level privileges on a site running Client Invoicing by Sprout Invoices version 20.8.13 or earlier - confirmed by CVSS PR:L. The practical risk is elevated on sites with open user registration enabled, since that allows any internet user to self-register and obtain the necessary credential. Sites where WordPress registration is disabled and all user accounts are trusted are at substantially lower risk, as the attacker must already hold a legitimate account. No additional non-default configuration is indicated as a prerequisite. Exploitation is limited to confidentiality impact (C:H); the CVSS I:N and A:N metrics confirm no data modification or service disruption is possible through this vulnerability alone.

The NVD-assigned CVSS 3.1 base score of 6.5 (Medium) reflects meaningful real-world risk. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates network exploitation with low complexity and no user interaction, requiring only a low-privileged account - the minimum bar for WordPress installations that allow open registration or have any non-admin users. The C:H metric signals that confidential data (likely client records, invoice details, or financial information) can be fully read by an unauthorized party. No EPSS data was provided; absent that signal, the Patchstack disclosure and PR:L requirement suggest moderate real-world exploitability rather than mass automated exploitation. No public exploit code has been identified, and the vulnerability is not listed in the CISA KEV catalog, which lowers immediate urgency but does not eliminate risk for sites with untrusted authenticated users. The tag 'Authentication Bypass' from the source data is somewhat misleading - the CVSS PR:L indicates authentication is still required, meaning this is authorization bypass rather than authentication bypass. Defenders should verify whether their WordPress installation permits open user registration, as that would lower the practical barrier to exploitation.

An attacker who holds or creates a low-privileged WordPress account (e.g., a Subscriber role on a site with open registration) sends a crafted request to a plugin endpoint that lacks proper capability checks. Because the missing authorization control is not enforced server-side, the request succeeds and returns confidential invoice records - client names, billing details, or financial figures - that the low-privileged user should not be permitted to view. No public exploit code has been identified at time of analysis, but the simplicity of the attack vector (low complexity, no user interaction) makes manual exploitation straightforward for any attacker aware of the affected endpoint.