Is CVE-2026-39562 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39562 being exploited in the wild.

How severe is CVE-2026-39562?

Medium severity, with a CVSS score of 5.3, published 8 April 2026.

Which products and versions are affected?

BoldGrid Client Invoicing by Sprout Invoices <= 20.8.10.

Is there a fix for CVE-2026-39562?

A patch was published on 2026-03-19: Version 20.8.11 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39562 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39562?

Check whether you run BoldGrid Client Invoicing by Sprout Invoices at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39562: BoldGrid Sprout Invoices missing authorization in Client Invoicing

Q: Is there a fix for CVE-2026-39562?

A patch was published on 2026-03-19: Version 20.8.11 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-39562 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-39562?

Check whether you run BoldGrid Client Invoicing by Sprout Invoices at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39562 · Severity: medium · CVSS 5.3 · Published 2026-04-08

A security flaw exists in the Sprout Invoices plugin for WordPress, which is used by businesses to manage client billing and invoicing. Due to a failure in verifying user permissions, an unauthorized person could potentially bypass security controls to perform actions they should not be allowed to. This could lead to unauthorized changes in the invoicing system, though it does not directly expose sensitive data or crash the site.

Vendors: BoldGrid.

Quick answers

Is CVE-2026-39562 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39562 being exploited in the wild.
How severe is CVE-2026-39562?: Medium severity, with a CVSS score of 5.3, published 8 April 2026.
Which products and versions are affected?: BoldGrid Client Invoicing by Sprout Invoices <= 20.8.10.
Is there a fix for CVE-2026-39562?: A patch was published on 2026-03-19: Version 20.8.11 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39562 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39562?: Check whether you run BoldGrid Client Invoicing by Sprout Invoices at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Missing Authorization (CWE-862) vulnerability exists in the BoldGrid Client Invoicing by Sprout Invoices plugin for WordPress. The flaw is rooted in incorrectly configured access control security levels, allowing unauthenticated attackers to execute functions that should be restricted to higher-privileged users. The attack can be carried out over the network without any user interaction. While the technical impact is categorized as partial integrity loss, it allows for the exploitation of administrative or restricted functions. The issue is resolved in version 20.8.11.

Affected products

BoldGrid Client Invoicing by Sprout Invoices <= 20.8.10

Timeline

2026-02-17: other: Vulnerability reported by researcher
2026-03-19: advisory: Patchstack advisory published
2026-04-08: disclosed: CVE published
2026-03-19: patched: Version 20.8.11 released to address the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.