WordPress Plugin Vulnerabilities

Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note

Description

The plugin does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.

Proof of Concept

Affects Plugins

Plugin icon
sprout-invoices
Fixed in 20.8.16

References

CVE
CVE-2026-87797

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Usama Arshad
Submitter
Usama Arshad
Submitter website
https://www.usamaarshad.me/
Submitter twitter
usama0x01
Verified
Yes
WPVDB ID
ded55e47-568d-4702-b043-4707e4182a09

Timeline

Publicly Published
2026-09-10 (about 2 days ago)
Added
2026-09-10 (about 1 day ago)
Last Updated
2026-09-10 (about 1 day ago)

Other

Published
Title
Published
2025-07-07
Title
Guest Support – Complete customer support ticket system for WordPress < 1.2.3 - Missing Authorization to Unauthenticated Ticket Deletion
Published
2024-11-18
Title
Classified Listing – Classified ads & Business Directory Plugin < 3.1.16 - Authenticated (Subscriber+) Limited Arbitrary Option Update
Published
2024-09-30
Title
Popup Maker < 1.20.0 - Missing Authorization
Published
2025-12-12
Title
Eyewear prescription form < 7.0.3 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Product Creation
Published
2026-01-19
Title
Order Listener for WooCommerce < 3.6.2 - Missing Authorization