CVE-2026-97078 in Client Invoicing Plugin
Summary
by MITRE • 09/30/2026
Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as an Unauthenticated Insecure Direct Object Reference within the Sprout Invoices plugin for WordPress, affecting versions up to and including 20.8.17, represents a critical failure in access control mechanisms that allows attackers to manipulate client identifiers directly through HTTP requests without requiring authentication credentials. This flaw stems from the application's reliance on user-supplied input, specifically invoice or client IDs passed via URL parameters or POST data, to retrieve sensitive financial records while failing to verify whether the requesting entity has legitimate authorization to view those specific objects. In a secure implementation, the system should validate that the authenticated user owns the requested resource or possesses administrative privileges; however, in this vulnerable version, the backend logic bypasses these checks entirely for certain endpoints, treating any provided identifier as valid regardless of its association with the current session or user context.
From a technical perspective, this vulnerability aligns closely with CWE-639, which categorizes Insecure Direct Object References where an application exposes internal implementation objects such as database keys or file names to end users without proper access control checks. The attacker can exploit this by enumerating sequential integer values in the request parameters, effectively performing a blind enumeration attack against the invoice database. Since Sprout Invoices handles sensitive financial data including client contact information, billing addresses, payment history, and outstanding balances, the ability to retrieve these records unauthenticated poses a severe risk to data confidentiality. The lack of authentication requirement means that any internet user with knowledge of the target site can access this data without triggering typical intrusion detection systems or requiring complex exploitation techniques beyond simple HTTP GET requests with manipulated parameters.
The operational impact of this vulnerability extends beyond mere data leakage, as it facilitates broader attacks against both the business and its clients. Compromised client invoices often contain personally identifiable information that violates privacy regulations such as GDPR or CCPA if exposed publicly, leading to potential legal liabilities for the website owner. Furthermore, detailed invoice data can be leveraged by threat actors for targeted phishing campaigns, where attackers use legitimate-looking financial documents to increase the credibility of social engineering attacks against employees or clients. The exposure also reveals internal business structures and cash flow patterns, providing adversaries with intelligence that could support further extortion attempts or competitive espionage activities.
Mitigation strategies must prioritize immediate remediation through software updates as well as defensive configuration changes if updating is not immediately feasible. Administrators should upgrade the Sprout Invoices plugin to version 20.8.18 or later, where the developers have implemented proper authorization checks ensuring that only authenticated users with appropriate permissions can access invoice details. For environments unable to update instantly, implementing a Web Application Firewall rule set designed to detect and block patterns associated with IDOR exploitation is recommended. This includes monitoring for sequential parameter manipulation in endpoints related to invoices and clients. Additionally, enforcing strict authentication requirements on all administrative and client-facing API endpoints ensures that no sensitive data retrieval occurs without valid session tokens or credentials, thereby closing the attack vector entirely until a permanent patch can be applied by the development team.