WordPress Plugin Vulnerabilities

Sprout Invoices – Client Invoicing & Estimates < 20.8.18 - Unauthenticated Insecure Direct Object Reference

Description

The Sprout Invoices – Client Invoicing & Estimates plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 20.8.17. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
sprout-invoices
Fixed in 20.8.18

References

CVE
CVE-2026-97078
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/36dea43a-ec72-4425-8ebb-933c79c87290

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
gueco
Verified
No
WPVDB ID
df25788b-2f03-42aa-8968-bef007f67a38

Timeline

Publicly Published
2026-09-24 (about 23 days ago)
Added
2026-09-30 (about 16 days ago)
Last Updated
2026-09-30 (about 16 days ago)

Other

Published
Title
Published
2023-05-15
Title
WooCommerce Ship to Multiple Addresses < 3.8.4 - Subscriber+ Shipping Address Disclosure via IDOR
Published
2025-05-05
Title
Reales WP STPT <= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Update
Published
2026-07-31
Title
User Profile Picture < 2.6.4 - Authenticated (Author+) Insecure Direct Object Reference
Published
2024-11-08
Title
SKT Addons for Elementor < 3.4 - Authenticated (Contributor+) Post Disclosure
Published
2023-07-24
Title
Simple Author Box < 2.52 - Contributor+ Arbitrary User Information Disclosure via IDOR