CVE-2026-57418
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The Client Invoicing by Sprout Invoices WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 20.8.13.
Risk Assessment
An attacker can gain unauthorized access to invoice functions and client data, leading to confidentiality and integrity breaches.
Recommendation
Immediately update the Client Invoicing by Sprout Invoices plugin to a version newer than 20.8.13 and review access control configurations.
Other vulnerabilities in Client Invoicing by Sprout Invoices
See all- CVE-2026-97078Medium
Insecure Direct Object References (IDOR) vulnerability in Client Invoicing by Sprout Invoices up to version 20.8.17. An unauthenticated user can access objects without logging in.
- CVE-2026-39562Medium
The Client Invoicing by Sprout Invoices plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 20.8.10.
Original NVD description (English source)
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.13.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS