CVE-2025-24606: WordPress Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress plugin <=20.8.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.1.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24606?
CVE-2025-24606 has been rated as a high severity vulnerability due to the potential for unauthorized access.
How do I fix CVE-2025-24606?
To fix CVE-2025-24606, upgrade the Sprout Invoices Client Invoicing to the latest version beyond 20.8.1.
What types of systems are affected by CVE-2025-24606?
CVE-2025-24606 affects systems running version 20.8.1 or earlier of the Sprout Invoices Client Invoicing and Easy Estimates and Invoices for WordPress.
What causes CVE-2025-24606?
CVE-2025-24606 is caused by missing authorization controls which lead to incorrectly configured access rights.
Can CVE-2025-24606 be exploited remotely?
Yes, CVE-2025-24606 can be exploited remotely if an attacker finds a way to access restricted features.