Is CVE-2026-57418 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57418 being exploited in the wild.

How severe is CVE-2026-57418?

Medium severity, with a CVSS score of 6.5, published 13 July 2026.

Which products and versions are affected?

BoldGrid Client Invoicing by Sprout Invoices <= 20.8.13.

Is there a fix for CVE-2026-57418?

A patch was published on 2026-07-13: Patch confirmed available in version 20.8.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57418 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-57418?

Check whether you run BoldGrid Client Invoicing by Sprout Invoices at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57418: BoldGrid Sprout Invoices Missing Authorization in Access Control

Q: Is there a fix for CVE-2026-57418?

A patch was published on 2026-07-13: Patch confirmed available in version 20.8.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57418 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-57418?

Check whether you run BoldGrid Client Invoicing by Sprout Invoices at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57418 · Severity: medium · CVSS 6.5 · Published 2026-07-13

A security flaw exists in the Sprout Invoices plugin for WordPress, which is used by businesses to manage client billing and invoicing. This vulnerability allows logged-in users with low-level permissions, such as subscribers, to bypass security checks and access sensitive information they should not be able to see. This could lead to the exposure of private financial data or client details, potentially impacting business operations and data privacy compliance.

Vendors: BoldGrid.

Quick answers

Is CVE-2026-57418 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57418 being exploited in the wild.
How severe is CVE-2026-57418?: Medium severity, with a CVSS score of 6.5, published 13 July 2026.
Which products and versions are affected?: BoldGrid Client Invoicing by Sprout Invoices <= 20.8.13.
Is there a fix for CVE-2026-57418?: A patch was published on 2026-07-13: Patch confirmed available in version 20.8.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57418 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-57418?: Check whether you run BoldGrid Client Invoicing by Sprout Invoices at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in the BoldGrid Client Invoicing by Sprout Invoices plugin for WordPress. The flaw is rooted in incorrectly configured access control security levels within the plugin's functions. An attacker authenticated with low-level privileges (such as a Subscriber) can exploit this lack of proper authorization checks to perform actions or access data intended for higher-privileged users. The vulnerability is reachable over the network without user interaction. A fix is available in version 20.8.14, which implements the necessary authorization checks.

Affected products

BoldGrid Client Invoicing by Sprout Invoices <= 20.8.13

Timeline

2026-05-25: other: Vulnerability reported by researcher she11f
2026-07-08: advisory: Patchstack advisory published
2026-07-13: disclosed: CVE published to NVD dataset
2026-07-13: patched: Patch confirmed available in version 20.8.14

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.