CVE-2026-87797 — Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note

CVE-2026-87797

Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note PUBLISHED

Description (CNA)

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.

Affected (CNA)

Vendor / product	Versions
Unknown / Sprout Invoices	affected 0 before 20.8.16

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/ded55e47-568d-4702-b043-4707e4182a09/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.