CVE-2026-25364mediumCWE-862

CVE-2026-25364: falha de média gravidade em BoldGrid Client Invoicing by Sprout Invoices

WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Client Invoicing by Sprout Invoices

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.2%
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
BoldGrid · Client Invoicing by Sprout Invoices
CVEs relacionadas — BoldGrid Client Invoicing by Sprout Invoices

No mesmo produto, das mais perigosas para as menos.

CVE-2024-53819MEDIUMWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.0 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.5%CVE-2026-32401HIGHWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2025-64227CRITICALWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2026-57418MEDIUMWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-24606MEDIUMWordPress Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress plugin <=20.8.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-39562MEDIUMWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.10 - Broken Access Control vulnerabilityEPSS 0.2%