CVE-2026-32401: WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerability

Q: What is the severity of CVE-2026-32401?

CVE-2026-32401 is classified as a critical vulnerability due to its potential for local file inclusion and remote exploitation.

Q: How do I fix CVE-2026-32401?

To fix CVE-2026-32401, update the Sprout Invoices plugin to version 20.9.0 or later.

Q: What systems are affected by CVE-2026-32401?

CVE-2026-32401 affects WordPress sites using the Sprout Invoices plugin version 20.8.9 and earlier.

Q: What is the impact of CVE-2026-32401?

The impact of CVE-2026-32401 includes potential unauthorized file access and exposure of sensitive data.

Q: Is there a patch available for CVE-2026-32401?

Yes, there is a patch available by updating the Sprout Invoices plugin to the latest version.

Published Mar 13, 2026

Updated

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows PHP Local File Inclusion.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.9.

Affected Software

1 affected component

wordpress/sprout-invoices<=20.8.9

Event History

Mar 13, 2026

CVE Published

via MITRE·11:42 AM

Data Sourced

via MITRE·11:42 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:54 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-32401?

CVE-2026-32401 is classified as a critical vulnerability due to its potential for local file inclusion and remote exploitation.

How do I fix CVE-2026-32401?

To fix CVE-2026-32401, update the Sprout Invoices plugin to version 20.9.0 or later.

What systems are affected by CVE-2026-32401?