CVE-2026-39562
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Client Invoicing by Sprout Invoices plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 20.8.10.
Risk Assessment
An attacker can gain unauthorized access to invoices and client data, leading to leakage of sensitive financial information and breach of confidentiality.
Recommendation
Update the Client Invoicing by Sprout Invoices plugin as soon as possible to a version that includes a security fix.
Original NVD description (English source)
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.10.