CVE-2026-87797: Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note

Q: Who can exploit this issue?

Any authenticated WordPress user, including a user with only the Subscriber role, can exploit it. The vulnerable AJAX action allows them to overwrite private notes on records belonging to other users.

Q: What access does an attacker need?

The attacker needs a valid authenticated WordPress account. No higher-privileged role or ownership of the affected record is required.

Q: Which plugin versions are affected?

Sprout Invoices versions earlier than 20.8.16 are affected. Updating to version 20.8.16 or later addresses the missing capability and ownership checks.

Published Sep 12, 2026

Updated

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.

Affected Software

1 affected component

Sprout Invoices WordPress plugin<20.8.16

Event History

Sep 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user, including a user with only the Subscriber role, can exploit it. The vulnerable AJAX action allows them to overwrite private notes on records belonging to other users.

What access does an attacker need?

The attacker needs a valid authenticated WordPress account. No higher-privileged role or ownership of the affected record is required.

Which plugin versions are affected?

Sprout Invoices versions earlier than 20.8.16 are affected. Updating to version 20.8.16 or later addresses the missing capability and ownership checks.