Description

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-12T06:16:27.660Z",
  "pubdate": "2026-09-12T06:16:27.660Z",
  "executiveSummary": "The Sprout Invoices WordPress plugin, in versions prior to 20.8.16, contains an Insecure Direct Object Reference (IDOR) vulnerability originating from a failure to perform adequate authorization checks within its AJAX handling mechanisms.\nThis vulnerability allows any authenticated user, including those with minimal privileges such as 'subscriber' accounts, to arbitrarily overwrite private notes associated with records belonging to other users or administrators.\nThe flaw stems from a lack of capability verification and ownership validation when processing requests to modify private note data.\nThe impact includes unauthorized modification of sensitive administrative or client-related communications, potentially leading to data manipulation, information integrity loss, or the injection of misleading data within the application's record-keeping system.\nExploitation requires the attacker to be authenticated to the WordPress installation but does not require higher-level administrative privileges, significantly lowering the barrier for entry for malicious actors.\nThis vulnerability poses a critical risk to business logic integrity within the Sprout Invoices ecosystem.",
  "technicalDetails": "The vulnerability is situated within the AJAX action processing logic of the Sprout Invoices plugin. The root cause is a deficiency in the plugin's security layer, specifically the absence of server-side capability checks (using functions such as current_user_can()) or ownership validation (checking the relationship between the current user ID and the target resource ID) before executing a note update or overwrite operation.\nWhen a user triggers the specific AJAX action responsible for note management, the server processes the request based on parameters provided in the POST body without verifying if the requesting user is authorized to modify the targeted record. Because the endpoint does not validate the security context of the requester, it accepts input from any authenticated user to perform write operations on protected data.\nThe attack flow proceeds as follows: First, the attacker authenticates to the WordPress platform. Second, the attacker identifies a target note ID, which can typically be enumerated through legitimate application usage or intercepting standard traffic. Third, the attacker crafts a malicious AJAX request directed at the vulnerable endpoint, supplying the note ID and the new content intended to overwrite the existing private note. Because the backend function lacks the necessary access control logic to verify if the note belongs to the current user, it proceeds to execute an UPDATE query in the database, successfully overwriting the target data.\nThis flaw effectively permits a low-privileged user to modify or sabotage sensitive records. Since Sprout Invoices manages financial and billing-related data, the ability to overwrite private notes could allow an attacker to alter internal instructions, change payment context, or manipulate audit trails. The impact is significant because it subverts the expected permission hierarchy of the application, allowing an attacker to exert control over data belonging to other users or privileged administrators.\nThis issue affects all versions of the Sprout Invoices plugin prior to 20.8.16. The vulnerability is accessible over the network, as the AJAX handler is exposed to any authenticated user session. The lack of validation for object ownership is a critical oversight in the plugin's architecture, as it fails to enforce the principle of least privilege, allowing users to move laterally across data segments they should not have access to modify."
}