CVE-2026-97078
MediumCVSS 5.3Summary
Insecure Direct Object References (IDOR) vulnerability in Client Invoicing by Sprout Invoices up to version 20.8.17. An unauthenticated user can access objects without logging in.
Risk Assessment
Risk of exposure of sensitive invoice or client data without authentication.
Recommendation
Update the Client Invoicing by Sprout Invoices plugin to the latest version.
Other vulnerabilities in Client Invoicing by Sprout Invoices
See all- CVE-2026-57418Medium
The Client Invoicing by Sprout Invoices WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 20.8.13.
- CVE-2026-39562Medium
The Client Invoicing by Sprout Invoices plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 20.8.10.
Original NVD description (English source)
Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS