EUVD-2026-89896
GHSA-wch3-pgc6-377m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed Sprout Invoices endpoint
-
ExploitIdentify object-ID parameter
-
ExecutionEnumerate/increment invoice or client IDs
-
ImpactRetrieve other users' billing records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the Client Invoicing by Sprout Invoices WordPress plugin (<= 20.8.17), requiring only network access to the site and the ability to manipulate an object-identifier parameter. The only meaningful limiting factors are that impact is confined to reading individual billing/invoice/client records (Low confidentiality, no write or availability effect) and that the plugin must be installed and its invoicing endpoints reachable; no authentication, privileges, or user interaction are required. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3 Medium) describes a fully remote, unauthenticated IDOR requiring no user interaction and low complexity, but with confidentiality-only impact rated Low and no integrity or availability effect - consistent with reading individual invoice/client records by iterating object identifiers rather than a mass or high-value data breach. No EPSS score, KEV listing, or public POC was provided in the input, so all three exploitation-likelihood signals are absent; per precision rules this is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The realistic priority is low-to-medium: exploitation is trivial and unauthenticated (favoring opportunistic scanning of exposed installs), but the payoff is limited to disclosure of one billing record class at a time (Low confidentiality), and the affected product is a niche WooCommerce/WordPress invoicing plugin rather than a broadly deployed platform. No conflicting signals were detected between the vector and the description - both point to unauthenticated remote confidentiality exposure. |
| Exploit ScenarioDerived | A remote unauthenticated attacker enumerates sequential or predictable invoice/client identifiers in Sprout Invoices request parameters and retrieves invoice, estimate, or client-record data belonging to other customers without any login. No POC was identified in the supplied intelligence, but the flaw's low complexity and absence of authentication or user interaction make manual or scripted enumeration straightforward against any exposed installation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Client Invoicing by Sprout Invoices versions up to and including 20.8.17 exposes an unauthenticated Insecure Direct Object Reference (IDOR) that lets a remote attacker read individual billing, invoice and client records simply by manipulating an object-identifier parameter. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base score 5.3 Medium) confirms the flaw is remotely reachable with low complexity and no authentication or user interaction, although impact is limited to low-severity confidentiality loss with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported through Patchstack and affects any WordPress site running the plugin at or below version 20.8.17.
RemediationAI
No vendor-released patch version is confirmed in the available data for CVE-2026-97078, so the primary action is to check the BoldGrid/Sprout Invoices update channel and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sprout-invoices/vulnerability/wordpress-client-invoicing-by-sprout-invoices-plugin-20-8-17-insecure-direct-object-references-idor-vulnerability?_s_id=cve) for a release newer than 20.8.17 and upgrade as soon as one is published; until then, the safest immediate step is to deactivate the plugin if invoicing functionality is not actively in use, accepting the loss of invoice delivery and client-portal features. If the plugin must stay running, restrict reachability of its invoice and client endpoints - for example, gate the plugin's shortcodes, REST routes and admin-ajax actions behind an authenticated role via a security plugin or a reverse proxy, or block unauthenticated requests to the specific AJAX/REST actions that take an invoice or client ID - with the trade-off that legitimate client-facing invoice links may break. Front-end WAF rules that reject requests whose invoice/client identifier parameters exceed plausible ranges or arrive at abnormal rates will slow enumeration but will not fix the missing authorization check, and access logs should be reviewed for sequential ID scanning as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the WordPress plugin Client Invoicing by Sprout Invoices, published by BoldGrid and indexed in the CPE dictionary as cpe:2.3:a:boldgrid:client_invoicing_by_sprout_invoices:*:*:*:*:*:*:*:*. This is a classic CWE-639 Authorization Bypass Through User-Controlled Key: the plugin's invoicing/client endpoints (AJAX or REST handlers that retrieve invoice, estimate and client records) accept an attacker-supplied object identifier and return the referenced record without verifying that the requester is the record's owner or holds the appropriate capability. Because the handler is reachable without an authenticated WordPress session - there is no current_user_can() style authorization gate and no nonce/ownership check before the lookup - the only barrier to exploitation is knowledge or enumeration of valid record IDs, which are typically sequential integers. The PR:N/UI:N portion of the vector reflects exactly this missing authentication and interaction requirement; the C:L scope reflects that the defect permits disclosure of individual records only, not modification or deletion of data and not a denial-of-service condition.
Know when Client Invoicing By Sprout Invoices gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote unauthenticated IDOR needing no interaction (AV:N/AC:L/PR:N/UI:N); discloses individual billing records for Low confidentiality with no integrity or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings
Sprout Invoices Client Invoicing versions 20.8.9 and earlier contain a local file inclusion vulnerability in PHP that al
Missing authorization controls in the Client Invoicing by Sprout Invoices WordPress plugin (versions through 20.8.13) al
BoldGrid Client Invoicing by Sprout Invoices versions 20.8.10 and earlier fails to enforce authorization controls, allow
Exploit-DB