Authorization Flaw in Sprout Invoices Plugin Allows Unauthorized Note Overwrites
CVE-2026-87797
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-87797?
The Sprout Invoices WordPress plugin before version 20.8.16 is vulnerable to an authorization bypass flaw in its AJAX actions. This vulnerability allows authenticated users, including those with lower privileges such as subscribers, to overwrite private notes on records that do not belong to them. Without adequate capability or ownership checks, any authenticated individual can manipulate sensitive data, which poses a significant risk to user privacy and data integrity in applications using this plugin.
Affected Version(s)
Sprout Invoices 0 < 20.8.16
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.