CVE-2026-39562
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Client Invoicing by Sprout Invoices plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 20.8.10.
Risk Assessment
An attacker can gain unauthorized access to invoices and client data, leading to leakage of sensitive financial information and breach of confidentiality.
Recommendation
Update the Client Invoicing by Sprout Invoices plugin as soon as possible to a version that includes a security fix.
Other vulnerabilities in Client Invoicing by Sprout Invoices
See all- CVE-2026-97078Medium
Insecure Direct Object References (IDOR) vulnerability in Client Invoicing by Sprout Invoices up to version 20.8.17. An unauthenticated user can access objects without logging in.
- CVE-2026-57418Medium
The Client Invoicing by Sprout Invoices WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 20.8.13.
Original NVD description (English source)
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS